Is penetration testing legal in the UK?
Yes, with proper authorisation. The Computer Misuse Act 1990 makes unauthorised access a crime, so the difference between a penetration test and an offence is usually permission from someone entitled to give it. Testing a system without it can be illegal, even with good intentions.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
Penetration testing is legal in the UK when it's properly authorised. Without authority, the same actions can be crimes under the Computer Misuse Act 1990, even if you mean well. The law doesn't have a general exception for good-faith security research.
Disclosure: this site is run by Precursor Security, which sells penetration testing. This guide is general information, not legal advice.
What the law says
| Offence | What it covers | Maximum on indictment |
|---|---|---|
| Section 1 | Causing a computer to perform a function intending to secure access you know is unauthorised | 2 years |
| Section 3 | Unauthorised acts intended to impair a computer, or reckless about doing so | 10 years |
| Section 3A | Making, supplying or obtaining tools for use in these offences | 2 years |
Three points matter for testers:
- Authority is the key test. Under section 17(5), access is unauthorised if you aren't entitled to control that kind of access and don't have consent from someone who is.
- Motive isn't a defence. Section 1 asks about your intent to get access and your knowledge that it's unauthorised, not whether you were trying to help.
- Recklessness counts under section 3. An authorised test that goes outside its scope and takes a service down could raise questions, so agree limits in advance.
Common situations
| Situation | Position |
|---|---|
| You hired a tester and own the systems | Legal if the test stays within your written authority |
| Your customer asks you to test a system on a hosting or cloud provider | Your customer may not be able to authorise everything, so check the provider's terms |
| You test a website you don't own, without permission, to report a bug | Risky, and may be an offence |
| You try SQL injection on a live site out of curiosity | Risky, and may be an offence |
| You scan the internet for exposed systems | Depends on what you do; don't assume it's safe, particularly if you interact with a system beyond what is public |
| You take part in a bug bounty | Stay inside the published scope. The programme's permission only covers what it says |
| You keep security tools for authorised work | Section 3A is about use in offences, so keep a clear record of legitimate purpose |
Where a situation looks borderline, get legal advice before testing rather than after.
What to get in writing
Before any test starts, a good authorisation should state:
- Who is authorising: their name, role and why they are entitled to authorise it
- What is in scope: IP addresses, domains, applications and accounts
- What is out of scope: especially third-party systems and fragile services
- Permitted techniques: for example, whether denial of service or social engineering is allowed
- Timing: start and end dates, plus any restricted hours
- Third-party permission: consent from cloud, hosting or other providers, where needed
- Data handling: what happens to any personal data the testers see
- Emergency contacts: who to call if something breaks, and how to stop the test
- Individuals covered: the testers or firm the authority applies to
Testers should carry a copy of this authority during the work, and keep records of what they did.
Could the law change?
Probably, but not through this Bill. The Cyber Security and Resilience Bill (CSRB) contains no provision amending the Computer Misuse Act. A Lords amendment seeking a review of a statutory defence was withdrawn at Committee Stage in September 2026.
Ministers told the Lords that the Home Office has finished its review and is proposing a defence under section 1 for accredited researchers carrying out certain activities. Reports in May 2026 suggested reform would go into a National Security Bill, and critics argue the proposal may be too narrow. Until a change is enacted, assume the current law applies in full.
Does the Bill require penetration testing?
The Bill's text for managed service providers requires appropriate and proportionate security measures, having regard to the state of the art. It doesn't state "you must run a penetration test". Testing can still help you show that your measures work, and regulator guidance may say more. See the compliance guide and the Computer Misuse Act glossary entry.
Sources
Frequently asked questions
Unauthorised access to computer material is a crime under section 1 of the Computer Misuse Act 1990, with a maximum of two years in prison on indictment. More serious offences carry longer sentences.
It can be. If you intend to access data or programs and know you are not authorised, it may be an offence, whatever your motive. The Act currently has no general defence for good-faith security research.
Someone entitled to control access to the systems being tested. Check this for third-party systems, because your customer may not be able to authorise testing of infrastructure owned by a cloud or hosting provider.
No. A Lords amendment seeking a review was withdrawn in September 2026. The Government has said the Home Office is proposing a defence for accredited researchers, separately from this Bill.