Computer Misuse Act
Computer Misuse Act 1990
The UK's main hacking law. It criminalises unauthorised access to computer material and related acts, and is the reason penetration testers need written authorisation.
In force: In force since 1990; amended several times, notably in 2006 and 2015
Who it applies to
Anyone, with jurisdiction where there is a significant link to the UK.
Key requirements
- Section 1: unauthorised access to computer material is an offence.
- Section 2: unauthorised access with intent to commit or facilitate further offences.
- Section 3: unauthorised acts intended to impair, or reckless as to impairing, a computer (for example malware or denial of service).
- Section 3ZA: unauthorised acts causing, or creating a significant risk of, serious damage.
- Section 3A: making, supplying or obtaining articles for use in these offences.
Breach and incident notification
Not a notification law. Victims may report offences to Action Fraud or the police.
Penalties
Criminal penalties that rise with the offence, from fines and short prison terms for basic unauthorised access up to life imprisonment for the most serious section 3ZA offences (serious damage to human welfare or national security).
Related frameworks
Shows up on these exams
Official source
legislation.gov.uk: Computer Misuse Act 1990Not legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
Security glossary
Practise this topic hands-on.
UK GDPR / DPA 2018
United Kingdom - Privacy & data protection
UK NIS Regulations
United Kingdom - Critical infrastructure
PECR
United Kingdom - Privacy & data protection
CFAA
United States (federal) - Cybercrime
IT Act 2000
India - Cybercrime
Budapest Convention
International / industry - Cybercrime