Part IX - General Provisions

58. Appeals

A person aggrieved by a decision of the Agency may, within thirty days of the decision, appeal to the High Court.

59. Search and seizure by law enforcement officer

1. A law enforcement officer may, with a warrant, enter any premises to search and seize a computer or computer system, where a computer or computer system contains material—
   1. or evidence necessary in proving an offence; or
   2. that has been acquired by a person as a result of an offence.
2. A law enforcement officer who is undertaking a search under this Act may, where the law enforcement officer has reasonable grounds to believe that the data sought is stored in another device, computer or computer system or part of it, and such data is lawfully accessible from or available to an initial device or system, extend the search or access to the other device or system.

60. Restoration of property

1. A law enforcement officer shall, where a person from whom a computer or computer system has been seized under section 59 is found not guilty or the proceedings against that person are withdrawn —
   1. within thirty days of the finding of the court or the withdrawal of proceedings, restore a computer or computer system to that person; or
   2. where the law enforcement officer is satisfied that the person cannot be found or is unwilling to receive the computer or computer system, apply to the court for an order of forfeiture of the computer or computer system.
2. Subject to the Forfeiture of Proceeds of Crimes Act, 2010, the court shall make an order of forfeiture under subsection (1) if —
   1. the law enforcement officer has given notice, by publication in the Gazette and in a daily newspaper of general circulation in the Republic, to the effect that the computer or computer system which has been seized under this Act shall vest in the State if it is not claimed within three months from the date of publication of the notice; and
   2. three months after the giving of the notice under paragraph (a), the computer or computer system remains unclaimed.
3. Where a claim is made, in writing, by a person that is lawfully entitled to the computer or computer system seized under this Part, the law enforcement officer may order the release of the computer or computer system to the claimant if satisfied that there is no dispute concerning the ownership of the computer or computer system and that it is not liable to forfeiture.

61. Assistance

A person, who is not a suspect of a crime or otherwise excluded from an obligation to provide assistance, but who has knowledge about the functioning of a computer or computer system or measures applied to protect the computer data that is the subject of a search under this Act may, permit and assist where reasonably required and requested by a person authorised to make the search by —

1. providing information that enables the undertaking of necessary measures in the circumstances;
2. accessing and using a computer system or computer data storage medium to search any computer data available to or in the computer system;
3. obtaining and copying such computer data; or
4. obtaining an intelligible output from a computer system in a format that is admissible for the purpose of legal proceedings.

62. Evidence obtained by unlawful interception not admissible in criminal proceedings

Despite any other law, evidence which is obtained by means of an interception effected in contravention of this Act, shall not be admissible in any criminal proceedings except with the leave of the court, and in granting or refusing such leave, the court shall have regard to the circumstances in which the evidence was obtained, the potential effect of its admission or exclusion on issues of national security and the unfairness to the accused person that may be occasioned by its admission or exclusion.

63. Prohibition of obstruction of law enforcement officer

1. A person who obstructs or hinders a law enforcement officer, in the exercise of any powers under this Act or neglects or fails to comply with a lawful order of a law enforcement officer commits an offence and is liable, on conviction, to a fine not exceeding two hundred thousand penalty units or to imprisonment for a term not exceeding two years, or to both.

64. Submission of information by controller

1. A controller shall, annually submit to the Agency in writing, such information as the Agency may determine.
2. A controller who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

65. General penalty

A person who commits an offence under this Act for which no penalty is provided for is liable, on conviction, in the case of —

1. an individual, to a penalty not exceeding five hundred thousand penalty units or to imprisonment for a period not exceeding five years, or to both; or
2. a body corporate or unincorporate body, to a penalty not exceeding one million penalty units.

66. Power of court to order cancellation of licence, forfeiture etc.

1. A court may, on conviction of a person of an offence under this Act order —
   1. forfeiture of —
      1. property constituting proceeds of such offence; or
      2. device or property used or intended to be used to commit or facilitate the commission of the offence; or
   2. the cancellation of a licence issued under this Act.
2. The Forfeiture of Proceeds of Crimes Act, 2010, applies in relation to an order of forfeiture made by the court under subsection (1).

67. Guidelines

1. The Agency may issue guidelines as are necessary for the better carrying out of the provisions of this Act.
2. The Agency shall publish the guidelines on the Agency’s website, in a daily newspaper of general circulation in the Republic, the Gazette or any other electronic platform.
3. The guidelines issued by the Agency under this Act shall bind all persons regulated under this Act and may include guidelines relating to —
   1. cyber incident reporting;
   2. cyber security;
   3. cyber resilience;
   4. critical information infrastructure risk assessments;
   5. critical information infrastructure data retention; and
   6. cyber incident management exercises.

68. Standards

The Agency may develop standards for the regulation of cyber security in the Republic.

69. Exemptions

1. The Agency may, by notice in the Gazette or daily newspaper of general circulation in the Republic, exempt a person or class of persons, for a limited or unlimited period of time, from the requirement to comply with the provisions of Part IV and Part VI.
2. The Agency may, where the Agency issues a notice under subsection (1), revoke its decision where it considers necessary to do so.
3. The Agency may where the Agency revokes its decision under subsection (2), publish the decision by notice in the Gazette or a daily newspaper of general circulation in the Republic.

70. Compounding of certain offences by Agency

Subject to the written consent of the Director of Public Prosecutions and where the Agency is satisfied after an investigation, and a person admits that the person has committed an offence under this Act, the Agency may compound the offence by collecting from that person a sum of money that the Agency considers appropriate, but not exceeding fifty percent of the maximum amount of the fine to which that person would have been liable on conviction, and a person having made that payment shall not thereafter be prosecuted in relation to the offence so compounded.

71. Administrative penalty

1. The Agency may impose an administrative penalty on a person for failure to comply with a provision of this Act which is not an offence.
2. An administrative penalty shall not exceed the amount prescribed by the President by statutory instrument for each day during which the failure continues.
3. An administrative penalty shall be paid to the Agency within the period prescribed by the President.
4. The Agency may, where a person fails to pay an administrative penalty within the stipulated period under subsection (3), by way of civil action in a competent court, recover the amount of the administrative penalty from that person as an amount due and owing to the Agency.

72. Regulations

1. The President may, on the recommendation of the Agency, by statutory instrument, make Regulations for the better carrying out of the provisions of this Act.
2. Despite the generality of subsection (1), the regulations may make provisions for —
   1. the form and manner of making applications for registration, licences, duration of licences and the fees payable on that application;
   2. critical sectors;
   3. baseline security requirements for critical information or critical information infrastructure;
   4. manner of hosting of critical information;
   5. factors to consider for hosting of critical information outside the Republic;
   6. cyber security services;
   7. categories of licences of cyber security services; or
   8. any other matter required to be prescribed under this Act.

73. Repeal of Act No. 2 of 2021

The Cyber Security and Cyber Crimes Act, 2021 is repealed.