Is it illegal to access someone's computer in the UK?

MacWindowsUpdated

In the UK, section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function intending to secure access to a program or data, where that access is unauthorised and the person knows it is. Section 170 of the Data Protection Act 2018 separately covers obtaining personal data without the controller's consent.

This page is general information, not legal advice. For a real case, speak to a solicitor.

Quick answer

Section 1 of the Computer Misuse Act 1990 sets out the offence of unauthorised access to computer material. The Crown Prosecution Service (CPS) says it covers employees who deliberately exceed their authority, and gives the maximum penalty on indictment as two years' imprisonment. Section 170 of the Data Protection Act 2018 is a separate offence about personal data.

What does section 1 of the Computer Misuse Act say?

Section 1(1) has three parts. A person is guilty of an offence if:

  1. "he causes a computer to perform any function with intent to secure access to any program or data held in any computer";
  2. "the access he intends to secure ... is unauthorised"; and
  3. "he knows at the time when he causes the computer to perform the function that that is the case."

Section 1(2) adds that the intent "need not be directed at" any particular program, data or computer. The CPS guidance puts the knowledge part plainly: "There has to be knowledge on the part of the offender that the access is unauthorised; mere recklessness is not sufficient."

What counts as unauthorised access?

The Act defines it in section 17(5). Access of any kind to a program or data held in a computer is unauthorised if the person:

  • "is not himself entitled to control access of the kind in question to the program or data"; and
  • "does not have consent to access by him of the kind in question to the program or data from any person who is so entitled".

The words "of the kind in question" matter. The test is about the kind of access, not only whether someone could use the computer at all.

Does it apply to people who already have access at work?

The CPS guidance says it does: "This covers not only hackers but also employees who deliberately exceed their authority and access parts of a system officially denied to them."

It also says what prosecutors look at in those cases: "careful consideration should be given to the employee's contract of employment, together with any surrounding information (for example oral advice given or office practices amongst others), in order to determine whether the employer had clearly defined the limits of the employee's authority."

So the guidance treats the limits an employer has set as central. It adds that in certain circumstances, prosecutors should consider the Data Protection Act 2018 instead.

Is reading someone's screen covered?

Not by this offence, according to the CPS. Its guidance says the offence "excludes mere physical contact with a computer and the scrutiny of data without any interaction with a computer (thus the reading of confidential computer output, the reading of data displayed on the screen, or 'computer eavesdropping', are not covered)."

That is about the Computer Misuse Act only. It says nothing about workplace rules, which may treat it differently. Our guide on shoulder surfing at work covers the practical side.

What are the penalties?

Section 1(3) sets them out. A person guilty of the section 1 offence is liable:

  • on summary conviction in England and Wales, to imprisonment for a term not exceeding "the general limit in a magistrates' court" or a fine not exceeding the statutory maximum, or both;
  • on summary conviction in Scotland, to imprisonment for up to 12 months or a fine not exceeding the statutory maximum, or both;
  • "on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine or to both."

The CPS lists heavier maximums for other offences in the Act. Section 2, unauthorised access with intent to commit or facilitate further offences, carries up to five years on indictment.

What about someone's personal data?

Section 170(1) of the Data Protection Act 2018 makes it an offence for a person "knowingly or recklessly" to "obtain or disclose personal data without the consent of the controller", among other things. Note the difference: section 1 of the Computer Misuse Act needs knowledge that access is unauthorised, while section 170 also covers recklessness. Its defences and penalty, and when reading someone's files becomes a data breach, are in is it a data breach if someone at work reads your files.

What does a recent case look like?

The Information Commissioner's Office (ICO) publishes its prosecutions. A recent example, as the ICO describes it:

  • Geoffrey Smith, 17 July 2026. A new employee at Herefordshire Council accessed approximately 490 records and downloaded 94 documents over four days. He pleaded guilty to an offence under section 1 of the Computer Misuse Act 1990 and was sentenced to two months' imprisonment suspended for 12 months, 120 hours' unpaid work, £2,000 costs and a victim surcharge of £154.

Each case turns on its own facts. This shows how the offence has been used, not how any other case would go. Section 170 cases are in the data breach guide.

More questions

Is it illegal to use someone's laptop without asking in the UK?

The Computer Misuse Act's section 1 offence needs a person to cause a computer to perform a function intending to secure access, where the access is unauthorised and they know it. Whether any particular situation meets that is a matter for the facts and the courts. For a real case, speak to a solicitor.

Does the Computer Misuse Act apply in Scotland and Northern Ireland?

On legislation.gov.uk, section 1 is marked as extending to the whole UK. Section 1(3) sets a separate summary penalty for Scotland: imprisonment for up to 12 months or a fine not exceeding the statutory maximum, or both.

Is the law the same in Ireland?

No, Ireland has its own law. Section 2 of the Criminal Justice (Offences Relating to Information Systems) Act 2017 says a person who, "without lawful authority or reasonable excuse, intentionally accesses an information system by infringing a security measure shall be guilty of an offence".

Who prosecutes these cases?

For Data Protection Act 2018 offences, the CPS guidance says that in England and Wales, proceedings may be instituted only by the Information Commissioner, or by or with the consent of the Director of Public Prosecutions. The ICO lists the case above among its own prosecutions. To report something that happened at work, see reporting snooping at work.

Where is the US version of this law?

The US federal law is the Computer Fraud and Abuse Act. We cover it, and the Supreme Court's Van Buren decision, in unauthorised computer access law in the US.

Sources