Cybersecurity and Computer Crime

The first step is to contain the incident and preserve the digital evidence: access logs, emails, screenshots, and system records, avoiding any alteration of the compromised equipment. That evidence is decisive for a potential criminal complaint under the offenses of Law No. 21,459 (Ley N° 21.459) on computer crimes. In parallel, it is worth assessing whether the attack affected personal data of clients or employees, which triggers obligations under Law No. 21,719 (Ley N° 21.719), and whether the organization is subject to reporting duties before the cybersecurity authority. Acting quickly and with counsel reduces the damage and improves your legal position.

It depends on the activity. Law No. 21,663 (Ley N° 21.663), which establishes the cybersecurity framework and creates the National Cybersecurity Agency (ANCI), requires operators of essential services and entities classified as being of vital importance to manage risks and to report incidents that have significant effects, within the deadlines set by the regulations. Even if your company does not fall within those categories, reporting and documenting the incident is usually advisable, and if personal data was affected, additional duties may arise under Law No. 21,719 (Ley N° 21.719). Whether a legal reporting obligation exists should be reviewed case by case.

Law No. 21,459 (Ley N° 21.459) criminalizes, among other conduct, unlawful access to a computer system, the improper interception of communications, attacks on the integrity of a system or of data (for example, damaging, deleting, or altering information), computer forgery, and computer fraud. It also punishes the misuse of devices created to commit these crimes. The law provides for aggravating circumstances when relevant services or infrastructure are affected. If you were the victim of any of this conduct, early preservation of the digital evidence is key to supporting the criminal complaint.

A personal data breach can give rise to liability under Law No. 21,719 (Ley N° 21.719) on personal data protection, which requires adopting adequate security measures and, depending on the case, notifying breaches that affect data subjects. A criminal dimension may be added if the origin was unlawful access or an attack punishable under Law No. 21,459 (Ley N° 21.459). The company must document the incident, assess the risk to the affected individuals, and review its contracts with technology vendors. An orderly response reduces subsequent penalties and claims.

Yes. Accessing another person’s system, email, or account without the holder’s authorization can constitute the crime of unlawful access under Law No. 21,459 (Ley N° 21.459), even if no information is modified or taken. Knowing the password is not the same as being authorized to use it. If, in addition, communications are intercepted, data is altered, or the information is used to defraud, other crimes under the same law may apply. Nor is it an excuse that the account belongs to a family member, an ex-partner, or a coworker: the holder’s authorization is what matters.

Digital evidence is fragile and can lose its value if mishandled. It is advisable not to shut down or format the compromised equipment, to keep access logs and emails in their original format, and to document each finding with its date and time. Screenshots, complete backups, and the chain of custody help prove the facts in a criminal complaint for offenses under Law No. 21,459 (Ley N° 21.459) or in a civil lawsuit. When the incident is significant, the recommended course is to engage a computer forensics expert and legal counsel before intervening in the systems, so as not to compromise the evidence.