Home / United Kingdom (England & Wales) / Cybercrime / hacking
Cybercrime / hackingPossibly — unconfirmed
Reported range, not yet confirmed against official text. Do not rely on this — awaiting confirmation.
Statutory range — reported, not yet confirmed
s.1 unauthorised access — summaryPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 12 months (general limit in a magistrates' court)
- Fine
- Unlimited fine (statutory maximum)
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
Either-way.
s.1 unauthorised access — on indictmentPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 2 years
- Fine
- Unlimited fine
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
s.2 unauthorised access with intent to commit / facilitate a further offence — summaryPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 12 months (general limit in a magistrates' court)
- Fine
- Unlimited fine (statutory maximum)
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
Either-way. Summary tier follows the same 'general limit' wording as s.1; not directly re-read.
s.2 unauthorised access with intent to commit / facilitate a further offence — on indictmentPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 5 years
- Fine
- Unlimited fine
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
The further offence need not actually be committed.
s.3 unauthorised acts impairing operation of a computer — summaryPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 12 months (general limit in a magistrates' court)
- Fine
- Unlimited fine (statutory maximum)
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
Either-way.
s.3 unauthorised acts impairing operation of a computer — on indictmentPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 10 years
- Fine
- Unlimited fine
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
Covers impairment done intentionally or recklessly, including denial-of-service attacks.
s.3ZA unauthorised acts causing or creating a risk of serious damage — on indictmentPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 14 years; life where the act causes or creates a significant risk of serious damage to human welfare / national security
- Fine
- Unlimited fine
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
Indictment figures per CPS / secondary summaries — needs official re-check. No summary tier stated here (not verified).
s.3A making / supplying / obtaining articles for use in a s.1, s.3 or s.3ZA offence — summaryPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 12 months (general limit in a magistrates' court)
- Fine
- Unlimited fine (statutory maximum)
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
Either-way.
s.3A making / supplying / obtaining articles for use in a s.1, s.3 or s.3ZA offence — on indictmentPossibly — unconfirmed
- Imprisonment
- 0 (no mandatory prison) – 2 years
- Fine
- Unlimited fine
0 = the law sets no minimum prison term. The court is not required to impose prison. Depending on the offence, jurisdiction, and case, it may instead impose a non-custodial sentence — e.g. a suspended sentence, community order / probation, a fine, or a discharge.
'Article' includes any program or data held in electronic form.
The CMA has no separate 'hacking' offence — 'hacking' maps to s.1 (access) and s.2 (access + further intent). Fraud, blackmail, harassment or damage committed using a computer are charged under their own statutes and are not covered by the CMA maxima.