# Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA, Article 12: Jurisdiction

Extent: E+W+S+N.I.

1. Member States shall establish their jurisdiction with regard to the offences referred to in Articles 3 to 8 where the offence has been committed:
(a) in whole or in part within their territory; or
(b) by one of their nationals, at least in cases where the act is an offence where it was committed.
2. When establishing jurisdiction in accordance with point (a) of paragraph 1, a Member State shall ensure that it has jurisdiction where:
(a) the offender commits the offence when physically present on its territory, whether or not the offence is against an information system on its territory; or
(b) the offence is against an information system on its territory, whether or not the offender commits the offence when physically present on its territory.
3. A Member State shall inform the Commission where it decides to establish jurisdiction over an offence referred to in Articles 3 to 8 committed outside its territory, including where:
(a) the offender has his or her habitual residence in its territory; or
(b) the offence is committed for the benefit of a legal person established in its territory.

---
Source: https://www.legislation.gov.uk/eudr/2013/40/article/12 (the official version)
Page: https://openlegislation.uk/eu-directive-2013-40/article-12
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.