| Guvnor

Enforced by: Home Office
Status: Amended (in force with amendments)
Penalty ceiling: Imprisonment 3 of 6 obligations carry imprisonment (10 years). 3 carry different penalties — flagged in the list below.

Does it bind you?

Business-side roles with duties under this instrument.

Any Person6

Other Acts binding the same actors

If a role above is yours, these are the other instruments that most often bind it.

Any Person — also bound by 2340 other Acts

Human Medicines Regulations 2012 184 duties

Merchant Shipping Act 1995 144 duties

Insolvency (England and Wales) Rules 2016 104 duties

Communications Act 2003 92 duties

Road Traffic Act 1988 92 duties

What it requires

Sections creating concrete business duties or carrying penalties, grouped as the instrument is structured. Titles link to the source text — blue means you’re leaving for legislation.gov.uk.

s.001 Unauthorised access to computer material. Imprisonment

Gain unauthorised access to computer materialAny Person

s.002 Unauthorised access with intent to commit or facilitate commission of further offences. Imprisonment

Unauthorised computer access with intent to facilitate a crimeAny Person

s.003 Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc. Imprisonment

Carry out unauthorised act that impairs computer operationAny Person

s.003 Making, supplying or obtaining articles for use in offence under section 1, 3 or 3ZA Imprisonment

Make, supply or obtain tools for computer misuseAny Person

s.003 Unauthorised acts causing, or creating risk of, serious damage Imprisonment

Carry out unauthorised computer act causing serious damageAny Person

s.006 Territorial scope of inchoate offences related to offences under this Act. Imprisonment

Conspiracy or attempt to commit computer misuse offencesAny Person

15 other provisions — procedural and definitional

s.004 Territorial scope of offences under this Act.

s.005 Significant links with domestic jurisdiction.

s.007 Territorial scope of inchoate offences related to offences under external law corresponding to offences under sections 1 to 3.

s.008 Relevance of external law.

s.009 British citizenship immaterial.

s.010 Savings

s.011 Proceedings for offences under section 1.

s.012 Conviction of an offence under section 1 in proceedings for an offence under section 2 or 3.

s.013 Proceedings in Scotland.

s.014 Search warrants for offences under section 1.

s.015 Extradition where Schedule 1 to the Extradition Act 1989 applies.

s.016 Application to Northern Ireland.

s.016 Northern Ireland: search warrants for offences under section 1

s.017 Interpretation.

s.018 Citation, commencement etc.

Help complying

Guvnor’s practical routes through this instrument.

Respond to a cyber attack

Emergency guidance for businesses experiencing a cyber attack. Immediate containment steps, who to report to, and what to do if personal data …

Cyber security fundamentals

A structured learning path for business owners new to cyber security. Understand the threat landscape, implement the five essential controls, prepare for …

Grow your tech business

Scale your tech business - funding, international expansion, investment, and preparing for exit

Run a tech business

Ongoing compliance, operations, and growth guidance for established UK tech and software businesses

PSTI IoT compliance check

Quick compliance check for IoT manufacturers, importers, and distributors. Confirm product scope, verify three mandatory security requirements, identify your supply chain role, …

Computer Misuse Act Compliance

How to comply with the Computer Misuse Act 1990 when conducting security testing, developing security tools, or running bug bounty programmes. Includes …

Tech Sector Compliance Overview

Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific requirements.

2 more guides that reference this instrument

Cyber security requirements for UK businesses Respond to a ransomware attack

Duty extraction and severity labels are Guvnor’s analysis of the instrument, not the instrument itself. Always verify against the linked source text.