On this page
What Is Unauthorized Access Under Kuwait Law?
Kuwait Law No. 63 of 2015 defines unauthorized access broadly. Under Article 2, it is a criminal offense for anyone to commit an unlawful entry into:
- A computer or its operating system
- An electronic data processing system
- An automated electronic system
- An information network (including the internet)
Critically, the law does not require that you steal or damage data for a crime to occur. Simply accessing a system you are not authorized to use is sufficient for prosecution.
Graduated Penalties: How Severity Affects Punishment
The law uses a tiered penalty system that increases based on what happens as a result of the unauthorized access.
Tier 1 — Basic Unauthorized Access (Article 2)
- Penalty: Up to 6 months imprisonment and/or a fine of KD 500 to KD 2,000
- Applies when: You access a system without permission, but cause no further damage
Tier 2 — Access with Consequences (Article 2, aggravated)
If the unauthorized access results in deletion, cancellation, destruction, disclosure, alteration, or copying of data or information, penalties increase substantially.
Tier 3 — Access to Government or Confidential Systems (Article 3)
- Penalty: Up to 3 years imprisonment and/or a fine of KD 3,000 to KD 10,000
- Applies when: The intrusion targets a government website or system, or is carried out with the intent to obtain classified government information or secret data
Real-World Scenarios for Expats
Understanding how this law applies in practice can help you avoid accidental violations:
- Using a colleague's login credentials to access a work system you are not authorized to use — even with their verbal permission — could constitute unauthorized access
- Accessing your employer's system after your employment ends without explicit authorization is a criminal offense
- Attempting to bypass network security at your workplace, school, or residential building falls under this provision
- Logging into someone else's email or social media account without their documented permission is prosecutable
- Using another person's Wi-Fi without permission may be considered unauthorized network access
Common Misconceptions
- "I didn't steal anything, so it's not a crime" — Wrong. Access itself is the offense under Kuwait law.
- "I had verbal permission" — Verbal permission is difficult to prove and may not be a valid defense. Always obtain written authorization.
- "It was a public network" — Accessing certain public-facing systems with intent to exploit vulnerabilities may still constitute an offense.
How to Protect Yourself as an Expat
- Never share passwords or access credentials with others, and do not use credentials that are not assigned to you
- Obtain written authorization before accessing any system on behalf of your employer or a third party
- Log out of all systems when changing jobs or roles, and confirm with your employer in writing that your access has been officially terminated
- If you work in IT or cybersecurity, ensure your job scope and authorized activities are clearly documented in your employment contract
- Be especially careful when conducting penetration testing or security audits — always have explicit written authorization
What Happens If You Are Investigated?
The Public Prosecution in Kuwait has sole authority to investigate cybercrime cases. If you are accused:
- Do not make statements to police or officials without a lawyer present
- Contact your embassy or consulate immediately
- Retain a licensed Kuwaiti attorney experienced in cybercrime cases
- Be aware that equipment and devices used in alleged offenses may be confiscated under Article 13
Reporting Unauthorized Access Against You
If someone has accessed your computer, accounts, or data without your permission, you have the right to file a complaint with Kuwait's Public Prosecution. Acting quickly is important given the statute of limitations — cases involving offenses with penalties up to 3 years must be filed within 2 years of the incident.