Cybercrime Law in the United Kingdom
The UK’s core computer-crime statute is the Computer Misuse Act 1990, supported by fraud, data-protection and investigatory-powers legislation.
Key laws
- Computer Misuse Act 1990 — the
central statute:
- s 1: unauthorised access to computer material
- s 2: unauthorised access with intent to commit or facilitate the commission of further offences
- s 3: unauthorised acts with intent to impair, or with recklessness as to impairing, the operation of a computer
- s 3ZA: unauthorised acts causing, or creating a risk of, serious damage — inserted by the Serious Crime Act 2015 with effect from 3 May 2015. The maximum is 14 years, rising to life imprisonment where the damage is to human welfare (loss of life, illness or injury) or to national security.
- s 3A: making, supplying or obtaining articles for use in an offence under s 1, s 3 or s 3ZA
- Fraud Act 2006 — fraud by false representation, by failing to disclose information and by abuse of position, plus possessing or supplying articles for use in fraud. This is the usual charge for online scams.
- Data Protection Act 2018 and the UK GDPR — data-protection and breach obligations. Both were substantially amended by the Data (Use and Access) Act 2025, so guidance written before 2025 may no longer be accurate.
- Investigatory Powers Act 2016 — interception, communications data and equipment interference, as amended by the Investigatory Powers (Amendment) Act 2024.
Scotland and Northern Ireland share these statutes, but prosecution and some procedural rules differ.
Enforcement
The National Crime Agency (NCA), its National Cyber Crime Unit and regional organised crime units lead enforcement, with cases prosecuted by the CPS (or COPFS in Scotland). The National Cyber Security Centre (NCSC) leads national cyber defence, and the Information Commissioner’s Office (ICO) regulates data protection.
Plain-language overview, not legal advice. Laws change — read the current statutes on legislation.gov.uk linked above and seek qualified advice for any specific matter.
Sources verified 9 August 2026 against legislation.gov.uk.