Loading Cyber Conduct…
Please wait while the page loads.
Loading Cyber Conduct…
Please wait while the page loads.
What South African law says about unlawfully acquiring, possessing, providing or using passwords, access codes and similar authentication information.
Section 7 makes it an offence to unlawfully and intentionally acquire, possess, provide to another person or use a password, access code or similar data or device for purposes of contravening specified cybercrime offences.
The section therefore concerns more than simply knowing somebody else's password. The intended unlawful purpose is an important part of the offence described by section 7.
Section 7's definition is broader than a traditional password. It includes several forms of authentication information and devices used to access or use data, computer programs, storage media or computer systems, as well as certain financial transactions.
The definition includes secret codes and PINs used for financial transactions or user authentication.
Security tokens and access cards can fall within the definition of a password, access code or similar data or device.
The definition expressly includes biometric data when it is used for financial transactions or user authentication.
Words or strings of characters or numbers used for authentication can also fall within the definition.
Obtaining authentication information for one of the prohibited purposes can fall within section 7.
Unlawful possession can also be covered when the required connection to the specified offences exists.
Providing a password, access code or similar information to another person can fall within the offence.
Using authentication information for the specified unlawful purposes can also constitute an offence.
Section 7 also provides for circumstances where a person is found in possession of a password, access code or similar data or device and there is a reasonable suspicion that it was acquired, possessed, provided or used for one of the specified unlawful purposes.
The Act provides for an offence where the person is unable to give a satisfactory exculpatory account of that possession.
People routinely possess passwords, PINs, access cards, security tokens and other authentication information for legitimate reasons. Section 7 connects the prohibited conduct to unlawful and intentional purposes involving specified offences.
This page is based on section 7 of the Cybercrimes Act 19 of 2020.
Read the Cybercrimes Act on justice.gov.zaCyber Conduct provides general educational information, not legal advice. The application of the law depends on the facts of an individual situation.