The cyber crime law in South Africa is the Cybercrimes Act 19 of 2020, in force since 1 December 2021. It criminalises unlawful access to computer systems, data interception, hacking tools, data interference, password offences, cyber fraud, cyber forgery, and cyber extortion, and it separately criminalises harmful data messages, including threats and the disclosure of intimate images without consent.
Before this Act, prosecutors had to stretch common law crimes and the old Electronic Communications and Transactions Act to fit digital conduct. The Cybercrimes Act replaced that patchwork with named offences, dedicated investigation powers, and penalties of up to 15 years’ imprisonment for aggravated offences. This guide sets out what the Act criminalises, the sentences, and what it means for ordinary internet users.
The Main Cybercrimes Created by the Act
Part I of Chapter 2 of the Act creates the core offences. Each requires unlawful conduct and intention, and the definitions of computer, data, and computer system are deliberately wide enough to cover phones, cloud accounts, and networks.
| Section | Offence | Maximum sentence |
|---|---|---|
| 2 | Unlawful access to a computer system or data storage medium, including hacking into an email or social media account | Fine or up to 5 years |
| 3 | Unlawful interception of data, including viewing or copying another person’s private messages | Fine or up to 10 years |
| 4 | Using or possessing hacking software or hardware tools for the listed purposes | Fine or up to 10 years |
| 5 | Unlawful interference with data or a computer program, including deleting, altering, or encrypting it, as in ransomware | Fine or up to 10 years |
| 6 | Unlawful interference with a computer data storage medium or computer system | Fine or up to 10 years |
| 7 | Unlawfully acquiring, possessing, providing, or using a password, PIN, or access code for the listed purposes | Fine or up to 10 years |
| 8 | Cyber fraud, being a misrepresentation by means of data intended to defraud | Sentence within the court’s penal jurisdiction |
| 9 | Cyber forgery and cyber uttering, making or passing off false data to defraud | Sentence within the court’s penal jurisdiction |
| 10 | Cyber extortion, threatening one of the listed acts to obtain an advantage or compel conduct | Sentence within the court’s penal jurisdiction |
| 11 | Aggravated offences, targeting restricted systems of financial institutions and organs of state, or conduct endangering life or public safety | Fine or up to 15 years |
Section 12 confirms that theft can be committed online, providing that the common law crime of theft includes the theft of incorporeal property, such as data, airtime, or cryptocurrency. Attempting, conspiring, or helping someone commit any of these offences is itself an offence under section 17, carrying the same penalty as the completed crime.
Malicious Communications: The Offences That Affect Everyone
Part II criminalises harmful data messages, and this is the part of the Act most likely to touch ordinary users. A data message includes WhatsApp texts, emails, posts, and shares.
- Section 14. Disclosing a data message intended to incite damage to property or violence against a person or group.
- Section 15. Disclosing a data message that threatens a person, or their family, with damage to property or violence, where a reasonable person would perceive it as a threat.
- Section 16. Disclosing an intimate image of a person without their consent, including images where the person is identifiable from other information. This is the revenge pornography offence.
Each malicious communication offence carries a fine or imprisonment of up to three years. Forwarding, posting, or sharing covered content is disclosure, so a person who redistributes a threat or an intimate image can be prosecuted alongside the original sender.
Investigation Powers and Reporting Duties
Chapter 4 gives the police expanded powers to search for, access, and seize data, computer programs, and devices under warrants, and to direct the expedited preservation of evidence. Some of these provisions, together with section 54, which will obligate electronic communications service providers and financial institutions to report listed cybercrimes to the police within 72 hours, were still awaiting commencement at the date of the last consolidated text of the Cybercrimes Act 19 of 2020.
Jurisdiction under section 24 is broad. A South African court can try a cybercrime committed anywhere in the world if the accused is found in the Republic, the offence affected a person or system in the Republic, or the accused is a citizen or resident, which is how foreign-based scammers targeting South Africans are reached.
What the Act Means for Ordinary Users
The Act is not only aimed at hackers. Logging into a partner’s email without permission can be unlawful access under section 2. Reading another person’s private WhatsApp messages by intercepting their notifications can fall under section 3. Sharing a leaked intimate image is a section 16 offence. Phishing emails that trick recipients into payments rest on cyber fraud under section 8.
Consent and lawful authority are the dividing lines. An employer accessing a company system it owns and controls, in terms of a lawful policy, is not committing an offence. The same employer rummaging through an employee’s private webmail on a company laptop without authority may be.
Common Mistakes to Avoid
- Sharing first, thinking later. Forwarding a threatening or violent message, or an intimate image, is disclosure and can be prosecuted even if you did not create it.
- Assuming account sharing is harmless. Using someone’s password to read their messages after a relationship ends is a textbook section 7 and section 2 offence.
- Paying a ransomware demand without advice. Payment does not guarantee restoration and complicates both the evidence and any later prosecution of the extortion.
- Not preserving evidence. Screenshots with dates, message threads, and URLs should be preserved immediately after online fraud or harassment, since data disappears quickly.
- Delaying the police report. Prompt reporting allows preservation directions to be sought before service providers cycle the data out of their systems.
- Confusing POPIA with the Cybercrimes Act. POPIA protects personal information and offers civil remedies. The Cybercrimes Act is criminal. The same conduct can engage both laws.
Frequently Asked Questions
What is the cyber crime law in South Africa?
The Cybercrimes Act 19 of 2020 is South Africa’s cyber crime law, in force since 1 December 2021. It criminalises hacking, data interception, data interference, password offences, cyber fraud, cyber forgery, and cyber extortion, and separately criminalises harmful data messages such as threats and non-consensual disclosure of intimate images.
What is the sentence for cybercrime in South Africa?
Sentences under the Cybercrimes Act 19 of 2020 range up to 5 years for unlawful access, 10 years for interception, data interference, hacking tools, and password offences, and 15 years for aggravated offences against banks, organs of state, or where life or public safety is endangered. Cyber fraud, forgery, and extortion are sentenced within the court’s penal jurisdiction.
Is sharing someone’s intimate images a crime in South Africa?
Yes. Section 16 of the Cybercrimes Act criminalises disclosing an intimate image of a person without their consent, including images where the person is identifiable from other information. The offence carries a fine or imprisonment of up to three years, and forwarding the image counts as disclosure.
Is hacking into someone’s email or social media account illegal?
Yes. Unlawfully and intentionally accessing another person’s email, social media, or other account is an offence under section 2 of the Cybercrimes Act, punishable by a fine or up to five years. Using or obtaining the password for that purpose is a separate offence under section 7 carrying up to ten years.
How do I report cybercrime in South Africa?
Report the matter at your nearest police station or to the South African Police Service’s cybercrime units, preserving screenshots, message threads, and transaction records first. In online fraud cases, also report to your bank immediately, and in harassment or harmful message cases, seek legal advice about protection options.
Disclaimer. This article is general information, not legal advice for a specific matter. Confirm current law against the Cybercrimes Act 19 of 2020 as amended, noting that some provisions await commencement, and consult an admitted attorney about any cybercrime allegation. Otrebski Attorneys’ criminal and commercial departments in Sandton handle cybercrime and online fraud matters.