Cyber Security (Amendment) Bill
Watch: AI-Powered Analysis
Watch an AI-generated discussion breaking down this bill in plain language, exploring its key provisions and potential impacts on Ghana's digital innovation sector.
Executive Summary
The Cyber Security (Amendment) Bill fundamentally transforms Ghana's Cybersecurity Authority from a regulatory body into a comprehensive law enforcement and certification agency. The bill expands the Authority's core functions to include investigating and prosecuting cybercrimes with Attorney-General approval, while granting its officers police powers including arrest, search, and seizure authority (2, 8). The Authority gains asset confiscation powers to seize property obtained through cybercrime and pursue civil asset recovery, subject to court confirmation (24). These enforcement capabilities are supported by extensive investigative tools: court-ordered data production from service providers (26, 27), search warrants for computer systems (28), and data preservation orders lasting up to 90 days with one renewal (30, 31). The bill establishes judicial oversight mechanisms requiring officers to demonstrate reasonable cause, proportionality, and privacy protections for uninvolved parties when seeking court orders.
The bill creates a comprehensive licensing and certification regime that regulates the entire cybersecurity ecosystem. All cybersecurity service providers—whether for-profit or non-profit—must obtain licenses or accreditation, with violations carrying penalties of 50,000-100,000 penalty units or damages plus financial gains (15). Individual cybersecurity professionals must be accredited to practice, and engaging unaccredited professionals triggers administrative penalties (16). The Authority will establish certification schemes for emerging technologies including AI, blockchain, cloud computing, quantum computing, and big data (20, 22). A notable provision standardizes fees for cyber hygiene certification services and requires certified professionals to contribute 30% of their revenue to the cybersecurity fund (19). While this framework aims to ensure quality standards and professional competence, it creates significant compliance requirements for businesses and practitioners, potentially raising operational costs and creating barriers to market entry for smaller providers.
The bill substantially enhances funding for cybersecurity operations through multiple revenue streams: 12% of communications service tax, 9% of corporate tax, portions of fines, licensing fees, and charges on government e-services (9). Critical information infrastructure owners face mandatory registration requirements with associated fees and must report cybersecurity incidents within specified timeframes (11). Sectoral Computer Emergency Response Teams must report incidents to the National CERT within 24 hours or face administrative penalties (14). The Authority can conduct premises inspections without warrants (except for homes) with reasonable cause and prior notice (32). These provisions create a robust incident response framework but impose ongoing compliance obligations on infrastructure owners and businesses, including audit requirements and directive compliance with financial penalties for violations.
The bill introduces significant online safety protections while expanding criminal liability. New offenses include cyberbullying and online harassment—covering threatening messages, fake profiles, non-consensual tracking, and spreading false information—with penalties of 1-10 years imprisonment (35). Cyberstalking becomes a distinct crime with similar penalties (36). The bill criminalizes computer-related forgery (intentionally altering data to create fake information for legal use) and computer-related fraud (causing property loss through data manipulation or system interference), both prosecuted under existing fraud laws (43, 44). Enhanced penalties apply to existing cybercrimes, with imprisonment now ranging from 3-10 years and fines from 250-25,000 penalty units (34, 37). The bill includes witness protection provisions requiring the Authority to maintain confidentiality of informants and ensure their safety (33). While these provisions strengthen protections for vulnerable groups—particularly children, for whom service providers must implement protective measures—they also expand the scope of criminal liability for online activities, raising questions about enforcement discretion and potential impacts on digital expression.
Impact Analysis
Digital Innovation
This bill creates a comprehensive regulatory framework that fundamentally constrains digital innovation in Ghana by requiring mandatory certification for all emerging technologies. The Authority gains power to certify the security of AI, blockchain, cloud technology, quantum computing, big data, and IoT before deployment (2,...
Freedom of Speech
The Cyber Security (Amendment) Bill poses severe threats to freedom of speech in Ghana's digital ecosystem through expansive criminalization of online expression coupled with vague legal standards and harsh penalties. The bill's cyberbullying and online harassment provisions (35) criminalize a broad spectrum of online communications using ill-defined terms such as...
Privacy & Data Rights
The Cyber Security (Amendment) Bill creates a complex privacy landscape that significantly expands government data access capabilities while implementing judicial safeguards. The most substantial privacy concern stems from 8, which grants Cybersecurity Authority officers full police powers including arrest, search, and seizure authority. This provision...
Business Environment
The Cyber Security (Amendment) Bill imposes severe operational and financial burdens on Ghana's business environment through a comprehensive regulatory framework that affects virtually all digitally-engaged businesses. The bill establishes mandatory licensing for all cybersecurity service providers and accreditation requirements for individual practitioners, with violations carrying...
Critical Issues with This Bill
These concerns pose significant risks to Ghana's digital innovation ecosystem
Vague "False Information" Crime Criminalizes Speech
This provision makes it a crime to "create false information about a person" or "post or disseminate false information about a person" with penalties of 1-10 years imprisonment. The terms "false information," "harass," and "stalk" are undefined, creating legal uncertainty about what speech is prohibited. The provision contains no exceptions for truth, good faith, opinion, satire, journalism, or public interest—protections fundamental to free speech in democratic societies. This broad criminalization with severe penalties creates a chilling effect on legitimate online expression including criticism, investigative journalism, whistleblowing, and academic debate. The overlap with 35 allows prosecutors to select between 1-3 year or 1-10 year penalties for similar conduct based on discretion rather than clear legal criteria.
Mandatory Certification Gatekeeps Emerging Technologies
The Authority gains power to establish mandatory certification schemes for AI, blockchain, quantum computing, big data, and IoT technologies, while requiring accreditation of all cybersecurity professionals and service providers. When combined with the bill's penalties for engaging unaccredited professionals (16), this creates a government approval requirement before deploying innovative technologies—transforming the Authority into a gatekeeper that could delay or block technology adoption. This regulatory burden is particularly problematic for startups and innovators who typically rely on rapid experimentation and iteration, potentially stifling Ghana's digital innovation ecosystem by requiring government approval at every stage of technology development and deployment.
Accreditation Regime Restricts Cybersecurity Market Entry
The Authority gains power to accredit all cybersecurity establishments, service providers, practitioners and professionals (4A(d)-(e)), converting what is typically an unregulated service sector in democracies into a licensed profession. Combined with penalties for engaging unaccredited professionals (16) and mandatory licensing fees (15), this creates significant barriers to market entry for cybersecurity businesses and restricts organizations' ability to hire cybersecurity talent. The provision establishes no explicit standards for accreditation decisions or appeal mechanisms, creating uncertainty for businesses seeking to enter or operate in Ghana's cybersecurity market.
Regulatory Agency Gains Police Powers
The provision grants arrest, search, and seizure authority to the same agency that licenses cybersecurity businesses and certifies emerging technologies. This concentration creates enforcement uncertainty for technology companies and innovators—regulatory disputes over licensing or certification could escalate to arrests and asset seizures by the same entity. The combination of regulatory control over market entry and police powers, without institutional separation, deters innovation and investment by creating governance risks not found in mature technology markets.
Regulatory Agency Can Arrest for Speech
This provision grants Cybersecurity Authority officers police powers including arrest, search, and seizure authority—the same powers as Police Officers under Ghana's criminal procedure laws. When combined with the bill's new cyberbullying and online harassment offenses (which criminalize "spreading false information" and "threatening messages"), this creates a severe chilling effect on online expression. Unlike independent police who operate under parliamentary oversight, Authority officers answer to a Director-General appointed by the President and can arrest individuals for speech offenses based on their own assessment, without independent review. This concentration of regulatory, investigative, and enforcement powers over online speech in a single agency violates democratic norms requiring separation of these functions.
Surveillance Powers Without Privacy Oversight
The provision grants arrest, search, and seizure powers to Authority officers who already control extensive data access mechanisms including production orders (26, 27), computer system searches (28), and 90-day data preservation (30). This concentration creates a surveillance apparatus without independent oversight—the same agency that compels service providers to produce user data can now arrest individuals and conduct searches, all while receiving 50% of criminal fines (9) that incentivize enforcement. Unlike independent police services with established privacy safeguards and judicial oversight, the Authority operates as a regulatory body with no privacy-specific limits on how these powers interact with its data access capabilities.
Regulator Gains Arrest Powers Over Licensees
The Cybersecurity Authority—which licenses and regulates cybersecurity businesses—gains police powers to arrest, search, and seize from the same entities it regulates. Combined with the Authority receiving 50% of criminal fines (9), this creates a conflict of interest where a regulator with financial incentives from enforcement can arrest licensees' employees and search their premises. This concentration of regulatory and law enforcement powers in a single agency undermines predictable business operations and creates risks of discriminatory enforcement.
Unconstrained Registration Fees and Requirements
The Authority can unilaterally set annual registration fees for critical information infrastructure owners "as determined by the Authority" with no specified limits or proportionality requirements. Combined with 10's broad CII definition (including "digital services" and ministerial discretion), this could capture businesses unexpectedly. The Authority also determines "any other matter relating to registration" through guidelines—creating unpredictable compliance obligations without parliamentary oversight or exemptions for smaller operators.
Mandatory Licensing Blocks Market Entry
This provision requires all cybersecurity service providers to obtain licenses from the Authority before offering services "for a reward," with penalties of 50,000-100,000 penalty units or damages plus financial gains for violations. Combined with 16 requiring individual practitioner accreditation, this creates a dual-layer gatekeeping regime that significantly raises barriers to market entry for startups, independent consultants, and smaller providers. The provision lacks defined licensing criteria, timelines, or appeal mechanisms, creating discretionary government control over who can participate in the cybersecurity market—a departure from OECD norms where such services operate in competitive markets with minimal pre-market licensing.
Severe Penalties Without Defined Licensing Criteria
The provision imposes mandatory licensing for all cybersecurity service providers with penalties of 50,000-100,000 penalty units (or damages plus financial gains) for violations, yet fails to specify licensing criteria, timelines, or appeal procedures. This creates severe regulatory uncertainty for businesses: providers cannot determine what standards they must meet to obtain licenses, how long approval will take, or how to challenge adverse decisions. The penalty structure makes no distinction between minor administrative violations and serious breaches, treating all unlicensed provision equally. Combined with 16 requiring individual accreditation, this creates a dual-layer compliance burden that significantly increases operational costs and market entry barriers, particularly for smaller providers and consultants.
Mandatory Accreditation Gatekeeps Cybersecurity Innovation
This provision requires all cybersecurity professionals and practitioners to obtain Authority accreditation before practicing, with penalties of 250-20,000 penalty units for violations. The requirement creates significant barriers to market entry for new practitioners, startups, and independent consultants who must obtain government approval before offering services. Combined with the organizational licensing requirement in 15, this establishes a dual-layer gatekeeping system unusual in technology sectors. The undefined scope of "cybersecurity professional or practitioner" could capture security researchers, educators, or consultants, chilling innovation and informal knowledge-sharing. The provision lacks criteria for accreditation, appeal mechanisms, or recognition of international qualifications, concentrating discretionary power in the Authority without transparent standards.
Dual Accreditation Burden Restricts Market Access
This provision requires all cybersecurity professionals to obtain Authority accreditation before practicing, while simultaneously prohibiting businesses from engaging unaccredited practitioners (250-20,000 penalty units). Combined with the preceding licensing requirement for service providers (50,000-100,000 penalty units), this creates a two-tier regulatory system unprecedented in OECD democracies where cybersecurity is typically unregulated. Businesses face cascading compliance obligations: verifying practitioner accreditation status, maintaining documentation, and bearing liability for engaging unaccredited individuals - creating operational costs and market access barriers that restrict competition and raise service delivery costs.
Price Controls Stifle Service Innovation
This provision mandates government-set flat rates for cyber hygiene certification services and requires certified providers to contribute 30% of revenue to the cybersecurity fund. This combination eliminates pricing flexibility, prevents service differentiation, and significantly reduces profitability—creating substantial barriers to market entry for startups and disincentives for investment in improved services. The Authority's dual role in both setting prices and collecting revenue creates a financial conflict of interest that undermines neutral regulation and market development.
Mandatory Revenue Sharing Undermines Profitability
This provision requires certified cybersecurity professionals to surrender 30% of their revenue to the cybersecurity fund while charging only government-mandated flat rates set by the Authority. This creates a business environment where the regulatory authority controls both pricing and extracts substantial revenue from the market it regulates—a financial conflict of interest that concentrates power and reduces business profitability. Combined with licensing requirements in 17 and 18, this creates high barriers to market entry and eliminates pricing flexibility that businesses need to compete and differentiate services.
Mandatory Certification Stifles Tech Innovation
This provision requires certification for all emerging technologies (AI, cloud, quantum computing, big data, blockchain) without defining what certification means, who needs it, or what exemptions exist. Combined with 23's criminal penalties (up to 5 years imprisonment) for operating without accreditation, this creates a mandatory pre-market approval regime that blocks experimentation and market entry. Unlike democratic precedents (EU AI Act), there are no exemptions for research, non-commercial use, or small providers—and no procedural safeguards, transparency requirements, or appeal mechanisms. This grants the Authority unconstrained gatekeeping power over Ghana's digital economy, creating insurmountable barriers for startups and researchers while established players absorb compliance costs.
Criminal Penalties Deter Market Entry
This provision makes it a criminal offense punishable by up to 5 years imprisonment to provide cybersecurity services without a license or act as a cybersecurity professional without accreditation. This goes far beyond standard regulatory practice—most democracies treat licensing violations as administrative matters with fines, not criminal imprisonment. For digital innovation, this creates an absolute barrier to market entry: startups cannot test services, researchers cannot conduct vulnerability research, and individual practitioners cannot operate informally before obtaining licenses. The vague directive-based offenses (criminalizing failure to comply with Authority directives) create additional uncertainty—innovators cannot know what conduct is criminal because it depends on executive directives that can change. Combined with the comprehensive licensing regime covering all cybersecurity providers, this will substantially deter entrepreneurship and shift innovation to established licensed entities, reducing competition and slowing innovation cycles in Ghana's cybersecurity sector.
Vague Offenses Enable Arbitrary Enforcement
This provision makes it a criminal offense (up to 5 years imprisonment) to "knowingly fail to comply with...directives issued under this Act"—but directives are executive instruments issued by the Authority itself, not parliamentary legislation. Businesses cannot know in advance what conduct is criminal since it depends on Authority directives that can change. The provision grants the Authority unfettered discretion to pursue "only criminal enforcement actions...or only administration enforcement actions...or a combination of both" without standards for when each applies, enabling selective enforcement. Combined with 24's grant of prosecution powers, the Authority becomes investigator, prosecutor, and beneficiary (fines fund its operations), creating conflicts of interest and operational uncertainty for businesses.
Criminalizing "False Information" Threatens Speech
Subsection (6) criminalizes spreading "false or misleading information with the intent to deceive or manipulate a person or a fact" with penalties of 1-3 years imprisonment. This extraordinarily broad language could capture satire, political commentary, journalism, academic debate, and opinion—all protected speech categories under international human rights law. The phrase "manipulate a person or a fact" is dangerously vague, potentially criminalizing persuasion or advocacy. Combined with vague definitions of "offensive," "rude," and "insulting" messages in the cyberbullying definition, this provision creates severe chilling effects on legitimate expression while granting authorities wide discretion to determine what constitutes prohibited speech.
Undefined "False Information" Chills Innovation
This provision criminalizes "creating false information about a person" with penalties up to 10 years imprisonment, but fails to define what constitutes "false information." This creates severe uncertainty for digital platforms, AI developers, and emerging technology companies who cannot determine what content violates the law. The provision explicitly applies to virtual, augmented and mixed reality platforms—technologies that inherently involve fictional identities and scenarios—potentially criminalizing core features of immersive technologies. Without safe harbors for satire, opinion, good-faith errors, or algorithmic content, platforms face pressure to over-moderate, startups face existential legal risk, and innovation in content creation, AI systems, and virtual worlds is substantially chilled.
Undefined "Cyberstalking" Creates Business Liability
This provision criminalizes "cyberstalking" including creating or disseminating "false information about a person" with penalties of 1-10 years imprisonment, but fails to define critical terms like "harass," "stalk," or "false information." This creates severe compliance uncertainty for businesses operating online platforms, communication services, or digital businesses—companies cannot develop clear content moderation policies or determine what user conduct violates the law. The broad scope captures legitimate business communications including customer reviews, competitive analysis, and commercial speech, while the severe penalties (up to 10 years) pressure platforms toward aggressive over-moderation. The provision overlaps with the preceding cyberbullying offense 35 but with higher penalties, creating prosecutorial discretion that compounds business uncertainty and raises operational costs.
Mandatory Minimums Deter Digital Innovation
This provision establishes mandatory minimum sentences of 3-10 years imprisonment for cybercrimes, removing judicial discretion to impose proportionate penalties. When combined with the vague "false information" offenses in 36, this creates extreme legal risk for digital platforms and startups hosting user-generated content. The mandatory minimums exceed international norms (OECD democracies typically allow 2-5 year maximums with judicial discretion) and create a risk-averse environment that deters legitimate online services, particularly platforms involving AI-generated content, social features, or data analysis where the boundaries of criminal liability are unclear.
Harsh Penalties Chill Online Speech
This provision establishes mandatory minimum sentences of 3-10 years imprisonment for cybercrimes, including offenses defined in 36 such as "creating false information" or "posting false information." The 3-year mandatory minimum removes judicial discretion to consider whether speech was mistaken versus malicious, opinion versus fact, or satire versus defamation. Combined with vague offense definitions, these severe penalties will chill legitimate online expression—journalists, whistleblowers, political critics, and ordinary citizens face potential imprisonment for speech that would be protected or subject only to civil remedies in most democracies. The mandatory minimum prevents proportionate sentencing and exceeds international norms for speech-related offenses.
Severe Penalties Create Business Uncertainty
This provision establishes mandatory minimum sentences of 3-10 years imprisonment and fines of 250-25,000 penalty units for cybercrimes, but operates in conjunction with 36's vague offense definitions including "creating false information." For digital businesses—particularly platforms hosting user-generated content, e-commerce sites, and data analytics companies—this creates severe legal uncertainty about when operations might trigger criminal liability. The mandatory minimums eliminate judicial discretion to account for offense severity or business context, forcing businesses to invest heavily in risk-averse compliance systems or avoid the Ghanaian market entirely. This penalty structure significantly exceeds international norms (most OECD democracies impose 2-5 year maximums), creating competitive disadvantages for Ghanaian digital businesses and deterring foreign investment in Ghana's digital economy.
Emergency Data Disclosure Without Judicial Review
This provision permits expedited disclosure of stored computer data in emergency situations without requiring judicial authorization, proportionality assessment, or notice to data subjects. While the emergency definition is narrow (significant risk to life/safety), the absence of procedural safeguards creates risk of overreach. International privacy frameworks like GDPR and the Budapest Convention recognize emergency exceptions but require either prior court approval or subsequent review, proportionality assessment, and documentation—none of which are mandated here.
Mandatory Licensing Creates Market Barriers
This provision establishes mandatory licensing for cybersecurity service providers and accreditation requirements for professionals (items k, l, o, p), creating significant barriers to market entry and ongoing compliance costs. Combined with penalties of 50,000-100,000 penalty units for operating without licenses (15), this extends professional regulation beyond what is typical in democracies—where licensing is reserved for professions with direct public safety implications. The catch-all clause "(p) any other matter required for ensuring cybersecurity" allows indefinite expansion of regulatory requirements without parliamentary oversight, creating legal uncertainty for business planning and disproportionately affecting small businesses and startups.
Unchecked Directives Threaten Innovation
The Authority gains broad power to issue directives to innovators and developers regarding "adoption and deployment of innovative and emerging technologies" without defining what these directives can require, what standards apply, or what procedural safeguards exist. This creates severe regulatory uncertainty for technology companies: they cannot predict what compliance requirements they may face when developing new solutions, and they have no notice, hearing, or appeal rights before directives are imposed. The provision could enable the Authority to mandate specific technology choices, implementation approaches, or security standards without technical justification, potentially forcing innovators to adopt solutions that are technically suboptimal or commercially disadvantageous. This regulatory unpredictability may deter companies from developing or deploying innovative technologies in Ghana, particularly in emerging areas like AI, blockchain, and quantum computing that the bill explicitly targets for regulation.
Undefined Directive Power Creates Compliance Chaos
The Authority gains sweeping power to issue directives to critical infrastructure owners, service providers, cybersecurity providers, innovators, and developers—but the provision never defines what "directives" are, what they can require, or what penalties apply for non-compliance. Businesses face regulatory uncertainty as they cannot predict what compliance obligations may be imposed, when, or through what process. With no notice, hearing, or appeal rights specified, the Authority can unilaterally impose operational requirements, technology mandates, or reporting obligations without demonstrating necessity or considering business impact, creating unpredictable compliance costs across Ghana's technology sector.
No Safe Harbor for Security Research
This provision criminalizes unauthorized access to computer systems and critical infrastructure (2-5 years imprisonment, up to 25,000 penalty units) without defining what constitutes "lawful authority" or providing explicit exemptions for security researchers, penetration testers, or bug bounty participants. Combined with the Authority's directive power over "innovators, developers" (41), this creates a regime where security researchers face criminal liability unless they obtain explicit Authority approval before testing—chilling legitimate vulnerability research and responsible disclosure practices that are essential to cybersecurity innovation.
Key Provisions
Section 3 of Act 1038 Amended
Plain Language Summary
This provision outlines the goals of the Cybersecurity Authority, which include overseeing cybersecurity practices and addressing threats. It aims to regulate key information infrastructure and promote a secure digital environment. The Authority will also work to prevent cybercrime, seize related illegal gains, foster collaboration between public and private sectors, raise awareness about cybersecurity, and partner with international organizations.
Show Original Legal Text
- The Cybersecurity Act, 2020 (Act 1038) referred to in the Act as the 'principal enactment' is amended by substitution for section 3, of
' Objects of the Authority
The objects of the Authority are to:
(a) regulate cybersecurity activities in the country;
(b) prevent, manage and respond to cybersecurity threats and cybersecurity incidents;
(c) regulate owners of critical information infrastructure in respect of cybersecurity activities, cybersecurity service providers, cybersecurity professionals and practitioners, and cybersecurity establishments in the country;
(d) promote the development of cybersecurity in the country to ensure a secured and resilient digital ecosystem;
(e) prevent and detect cybercrime;
(f) to facilitate the confiscation of proceeds of cybercrime;
(g) establish a platform for cross-sector engagement on matters of cybersecurity for effective co-ordination and co-operation between key public institutions and the private sector;
(h) create awareness of cybersecurity matters; and
(i) collaborate with States, inter-governmental bodies, international organisations and international agencies to promote the cybersecurity of the country.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 4A inserted
Related Key Concerns
Plain Language Summary
This provision expands the Authority's role to include investigating and prosecuting cybercrimes with the Attorney-General's approval. It also tasks the Authority with setting security standards and certifying innovative technologies like AI and blockchain. Additionally, the Authority will accredit cybersecurity entities, promote online safety for vulnerable groups, and work to protect digital rights in the cybersecurity space.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 4, of
' Further Functions of the Authority
4A. The Authority, shall in addition to the functions in section 4, carry out the following functions:
(a) subject to article 88 of the Constitution, to investigate and on the authority of the Attorney-General, prosecute cybercrime under this Act;
(b) establish standards for certifying the security of innovative products, Artificial Intelligence, cloud technology, quantum computing, big data, Internet of Things (IoT) , blockchain-based technology and any other emerging technologies;
(c) certify the security of innovative products Artificial Intelligence, cloud technology, quantum computing, big data, Internet of Things (IoT), blockchain-based technology and any other emerging technologies, in accordance with the standards established pursuant to paragraph (b);
(d) accredit the cybersecurity establishments of critical information infrastructure owners, cybersecurity service providers, cybersecurity practitioners and professionals and other relevant persons or institutions;
(e) accredit non-profit cybersecurity institutions and cybersecurity professional bodies;
(f) promote the online protection of women, elderly, persons with disabilities and underserved populations;
(g) collaborate with relevant institutions to develop mechanisms including technical security solutions and guidelines on the usage of smart technology and other emerging technologies; and
(h) promote the protection of digital rights as it relates to cybersecurity.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 5 of Act 1038 amended
Plain Language Summary
This provision modifies a section of Act 1038 to include "Foreign Affairs and Regional Integration" and "Gender, Children and Social Protection" in a specific list. The change expands the scope of the list to formally include these two areas. The specific impact of this change depends on the context of the original section in Act 1038.
Show Original Legal Text
The principal enactment is amended in section 5 by the addition after subparagraph (iv) of paragraph (a) of subsection (1), of
- '(v) Foreign Affairs and Regional Integration; and - (vi) Gender, Children and Social Protection.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 13 of Act 1038 amended
Plain Language Summary
This section modifies the composition and operation of the Joint Cybersecurity Committee. It updates the titles of member organizations, allows for the nomination of representatives with cybersecurity expertise, and permits the Minister to appoint additional members. The amendment also establishes rules for membership termination due to absenteeism and outlines the process for filling vacancies.
Show Original Legal Text
The principal enactment is amended in section 13 by:
(a) the substitution for paragraph (d) of subsection (2), of
- '(d) the Executive Director of the Data Protection Commission or any successor official or entity by whatever name designated, or a representative of the Executive Director with the requisite knowledge and skills in cybercrime and cybersecurity matters, nominated by the Executive Director;';
(b) the substitution for paragraph (g) and (k) respectively of subsection (2), of
- '(g) the Director of the National Intelligence Bureau or any successor official or entity by whatever name designated, or a representative of the Director with the requisite knowledge and skills in cybercrime, and cybersecurity matters, nominated by the Director;
(k) the Director General of National Signals Bureau or any successor official or entity by whatever name designated, or a representative of the Director with the requisite knowledge and skills in cybercrime and cybersecurity matters, nominated by the Director;';
- (c) the addition after paragraph (r) of subsection (2), of
'(s) Any other person the Minister may nominate, on the advice of the Authority.'.
- (d) the addition after subsection (13), of
'(14) A member of the JCC who is absent from three consecutive meetings without sufficient cause ceases to be a member of the JCC.
Where there is a vacancy, the Minister shall notify the President of the vacancy, and the President shall appoint a person to fill the vacancy for the unexpired term.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 14 of Act 1038 amended
Plain Language Summary
This section updates the responsibilities of the Joint Cybersecurity Committee, requiring them to work with the Authority and other sectors to implement cybersecurity measures. This includes identifying cybersecurity risks, creating policies, coordinating cybersecurity activities, and sharing information securely. The committee will also address cybercrime, evaluate the effectiveness of security measures, and educate the public on cybersecurity.
Show Original Legal Text
The principal enactment is amended in section 14 by the substitution for subsection (1), of
'14 (1). The Joint Cybersecurity Committee shall collaborate with the Authority and the sectors or institutions represented on the Committee for the implementation of relevant cybersecurity measures including but not limited to the following ways:
(a) identification of cybersecurity risks that may affect critical information infrastructure or the overall cybersecurity of the country;
(b) development of cybersecurity policies and guidelines based on identified risks, best practices and international standards to mitigate cybersecurity risks;
(c) coordination of cybersecurity activities between sectors and entities to ensure that all cybersecurity efforts are aligned to prevent overlap and gaps;
(d) facilitate the sharing of information between sectors and entities in a secure manner and in compliance with relevant data protection laws;
(e) collaboration with sectors or institutions to tackle cybercrime including the provision of a platform for incidence sharing and incidence response mechanisms to facilitate;
(f) evaluation of the effectiveness of implemented cybersecurity measures based on established metrics with a view to continuously improve the cybersecurity measures; and
(g) collaboration with the Authority to educate the public on matters related to cybercrime and cybersecurity.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 15A inserted
Plain Language Summary
This provision establishes the position of Deputy Directors-General within the Authority. These deputies are appointed by the President, serve under terms specified in their appointment letters, and step in when the Director-General is unavailable. They also support the Director-General in their duties and carry out tasks assigned by the Director-General or the Board.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 15, of
' Appointment of Deputy-Directors General
15A. (1) The President shall in accordance with article 195 of the Constitution appoint such Deputy Directors-General as are necessary for the performance of the functions of the Authority.
The Deputy Directors-General shall hold office on the terms and conditions specified in the letters of appointment.
The Deputy Directors-General shall act in the absence of the Director-General and perform any other functions as determined by the Board.
The Deputy Directors-General shall, subject to the provisions of this Act:
(a) assist the Director-General in the discharge of his functions and perform such other functions as the Director-General or the Board may delegate to him;
(b) perform functions related to the object and functions of the Authority on the direction or authority of the Director-General or the Board; and
(c) be responsible for the direction of the Authority when the DirectorGeneral is absent from Ghana or is otherwise unable to perform his functions.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 20A inserted
Plain Language Summary
This provision ensures that staff of the Authority receive terms and conditions of service that are competitive with those of security and intelligence agencies. Legal officers within the Authority will have service conditions comparable to those of legal officers in the Attorney-General's office. Staff are also entitled to benefits such as gratuities, allowances, and pensions.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 20, of
' Terms and Conditions of Service of Staff of the Authority
20A. (1) The terms and conditions of service of the staff of the Authority shall not be less favourable than the staff of the security and intelligence agencies.
The conditions of service attached to posts of legal officers of the Authority shall not be less than that of the posts attached to that of legal officers of the Attorney-General of the same rank.
Staff shall, in addition to monthly salaries, be eligible for the payment of any gratuity, allowance, pension, subsidy or benefit to members in respect of their service or resignation or retirement.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 20B inserted
Related Key Concerns
Plain Language Summary
This provision gives the Director-General, Deputy Director-General, and other authorized officers the authority of police officers. This includes the power to arrest, search, and seize. They also receive the same legal protections and rights as police officers when performing their duties under this Act.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 20, of
' Powers of police
- 20B. (1) The Director-General, Deputy Director-General and other authorised officers shall exercise the powers of a Police Officer, including the powers of arrest, search and seizure and have the same rights, protections immunities conferred on a Police officer in the Criminal and Other Offences (Procedure) Act, 1960 (Act 30), the Police Service Act, 1970 (Act 350) and any other law related to a Police officer in the performance of their functions under the Act.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 31 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This provision outlines where the fund receives its money. Funding sources include parliamentary allocations, portions of fines and taxes, grants and donations, charges on licensed businesses, and fees from government e-services. The specific percentages for communications service tax and corporate tax allocated to the fund are 12% and 9% respectively. These various revenue streams ensure the fund has the financial resources to operate.
Show Original Legal Text
- The principal enactment is amended by substitution for section 31, of:
' Sources of money for the Fund
The sources of moneys for the Fund include:
(a) seed money approved by Parliament;
(b) moneys which may become lawfully payable to the Authority for the Fund;
(c) 50% of all fines arising from criminal penalties under the Act;
(f) grants, gifts, donations and other voluntary contributions;
(g) 12% of the communications service tax for the Fund per annum;
(h) 9 % corporate tax for the Fund per annum;
(i) a charge determined by the Authority in accordance with the Fees and Charges (Miscellaneous Provisions) Act, 2018 (Act 983) and levied on persons licensed by the Bank of Ghana to carry on business;
(j) a proportion of the fees charged on all government electronic services determined by the Authority; and
(h) any other moneys approved by Parliament for the Fund.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 35 of Act 1038 amended
Plain Language Summary
This provision allows the Minister to designate computer systems or networks as critical infrastructure if they are essential for national security, economic stability, or public safety. Once designated, the sector of the infrastructure will be published, and the owner will be notified. The Minister will consider various factors, including the system's importance to key services and government functions. The Minister will also create regulations for these critical infrastructures.
Show Original Legal Text
- The principal enactment is amended by substitution for section 35, of
' Designation of critical information infrastructure
- (a) national security,
- (b) the economic and social well-being of citizens, or
- (c) public health and safety.
Where the Minister designates a computer system or computer network as a critical information infrastructure, the Minister shall publish the sector of the designated critical information infrastructure in the Gazette and, the owner of the Critical Information Infrastructure shall be notified of the designation.
The Minister shall, in making a determination under subsection (1), consider if the computer system or computer network is necessary for:
(a) the security, defence or international relations of the country;
(b) the production, preservation or identity of a confidential source of information related to the enforcement of criminal law;
(c) the provision of services directly related to
(i) communications and telecommunications infrastructure;
(ii) banking and financial services;
(iii) public utilities
(iv) public transportation; and
(v) public key infrastructure;
(d) the protection of public safety and public health, including systems related to essential emergency services;
(e) an international business or communication affecting a citizen of Ghana or any other international business in which a citizen of Ghana or the Government has an interest;
(f) the Legislature, Executive, Judiciary, Public Services or security agencies; or
(g) digital services;
(h) services related to the supply chain in the critical information infrastructure ecosystem; and
(i) any other services determined by the Minister, on the advice of the Authority.
The Minister shall, by publication in the Gazette , establish the procedure for the regulation of a critical information infrastructure.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 36 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This provision mandates that owners of critical information infrastructure must register with the designated authority and pay associated fees. Owners must provide contact information and verified details of their infrastructure. The authority will validate the information and issue a registration certificate, and non-compliance can result in penalties.
Show Original Legal Text
- The principal enactment is amended by substitution for section 36, of
' Registration of critical information infrastructure
(1) The Owner of the designated critical information infrastructure shall register their critical information infrastructure with the Authority, and shall pay the prescribed annual registration and designation fee as determined by the Authority or stipulated in a legislative instrument.
For compliance purposes, the owner of an unregistered critical information infrastructure shall receive a notification of registration letter from the Authority to comply with the Act.
During registration, the owner of a critical information infrastructure shall nominate a point of contact and submit details of the nominee to the Authority.
The owner of a critical information infrastructure shall submit to the Authority, verified details of critical information infrastructure, through the channels and modalities determined by the Authority.
The Authority shall validate the information submitted by the owner of a critical information infrastructure, and the owner shall receive a Certificate of Registration upon completion of registration requirements.
The Authority shall through the issuance of guidelines or directives determine:
(a) further requirements for the registration of a critical information infrastructure;
(b) the procedure for the registration of a critical information infrastructure; and
(c) any other matter relating to the registration of a critical information infrastructure.
Where there is any change in the legal ownership of a designated critical information infrastructure, the owner of the designated critical information infrastructure shall, within seven days after the change, inform the Authority of the change in ownership.
An owner of a designated critical information infrastructure who contravenes subsection (1) and (3) is liable to pay to the Authority the administrative penalty specified in the Second Schedule.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 37 of Act 1038 amended
Plain Language Summary
This section allows the Minister to remove the "critical information infrastructure" label from a computer or network if it no longer meets the necessary requirements. The decision is made based on the Authority's advice. The removal can be publicly announced, and the owner of the infrastructure will be informed directly.
Show Original Legal Text
- The principal enactment is amended by substitution for section 37, of
' Withdrawal of designation of critical information infrastructure
'37. (1) The Minister may, on the advice of the Authority, withdraw the designation of a critical information infrastructure at any time if the Minister considers that
The Minister may publish the withdrawal of critical information infrastructure sector in the Gazette .
The owner of a designated critical information infrastructure shall receive notification of the withdrawal of the designation by letter from the Minister.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 40 of Act 1038 amended
Plain Language Summary
This provision changes the fine amount for violating a specific rule. If someone breaks this rule, they will now have to pay a fine between 4,000 and 25,000 penalty units if convicted in court. The court may also impose both a fine and another form of punishment.
Show Original Legal Text
The principal enactment is amended in section 40 by substitution for subsection (2), of
'(2) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a fine of not less than four thousand penalty units and not more than twenty-five thousand penalty units, or both.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 47 of Act 1038 Amended
Plain Language Summary
This amendment requires Sectoral Computer Emergency Response Teams to report cybersecurity incidents to the National Computer Emergency Response Team within 24 hours. Failure to report incidents within this timeframe will result in an administrative penalty. This change is intended to improve the speed and effectiveness of responses to cybersecurity incidents.
Show Original Legal Text
The principal enactment is amended in section 47 by:
(a) the addition after subsection (6), of
'(7) A Sectoral Computer Emergency Response Team shall within twenty-four hours after receiving a report of a cybersecurity incident from the owner of a designated critical information infrastructure, a service provider, a licensee or any relevant person report the cybersecurity incident to the National Computer Emergency Response Team.'.
(b) the addition after subsection (7), of
'(8) A Sectoral Computer Emergency Response Team who contravenes subsection (7) is liable to pay to the Authority the administrative penalty specified in the Second Schedule.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 49 of Act 1038 Amended
Related Key Concerns
Plain Language Summary
This amendment mandates that anyone offering cybersecurity services, whether for profit or non-profit, must obtain a license or accreditation from the Authority. Failure to comply can result in a penalty equivalent to the damages caused plus any financial gain, or a fine between 50,000 and 100,000 penalty units. This aims to regulate cybersecurity service providers and ensure compliance through financial penalties.
Show Original Legal Text
The principal enactment is amended in section 49 by
(a) the substitution for subsection (1), of
'(1) A person shall not provide a cybersecurity service for a reward unless that person obtains a licence issued by the Authority in accordance with the Act.'.
(b) the substitution for subsection (2), of
(c) addition after subsection (2), of
'(3) A person who contravenes subsection (1) and (2) is liable to pay to the Authority the administrative penalty the equivalent to the cost of damage caused and value of the financial gain made, or an administrative penalty of not less than fifty thousand penalty units and not more than one hundred thousand penalty units.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 57 of Act 1038 Amended
Related Key Concerns
Plain Language Summary
This provision requires the Authority to establish an accreditation process for cybersecurity professionals. Individuals must be accredited to work as cybersecurity professionals or practitioners. Engaging the services of someone who is not accredited is prohibited and punishable by administrative penalties.
Show Original Legal Text
The principal enactment is amended by the substitution for section 57, of
The Authority shall establish a mechanism for the accreditation of cybersecurity professionals and practitioners.
An individual shall not practise as a cybersecurity professional or cybersecurity practitioner unless that individual has been accredited by the Authority;
A person shall not knowingly engage the services of a cybersecurity professional or cybersecurity practitioner who has not been accredited by the Authority;
A person who contravenes subsection (2) or (3) is liable to pay to the Authority an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty thousand penalty units.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 57A inserted
Plain Language Summary
This provision directs the Cyber Security Authority to develop a certification scheme for cybersecurity professionals and service providers. This certification offers an alternative to existing international security standards. The Cyber Security Authority will perform regular audits to ensure adherence to the scheme and will investigate any reported violations.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 57, of
' Cyber hygiene certification scheme
57B. (1) The Authority shall establish a scheme for the certification of cybersecurity professionals and practitioners, and cybersecurity service providers who will be entrusted to perform cyber hygiene certification service as an alternative to other international best practice security frameworks.
The Cyber Security Authority shall conduct periodic audits to ensure compliance with the cyber hygiene certification scheme and associated prescribed fees.
Any complaints regarding non-compliance shall be investigated, and appropriate enforcement actions shall be taken.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 57B inserted
Plain Language Summary
This provision establishes a process for licensed cybersecurity providers or accredited professionals to become certified to offer cyber hygiene certification services. To become certified, providers must apply in writing to the Authority. The application needs to include supporting documents and the necessary fee.
Show Original Legal Text
' Application for certification to provide the Cyber hygiene certification services
57B. (1) A licensed cybersecurity service provider or accredited CP who seeks to provide the Authority's cyber hygiene certification service shall apply in writing to the Authority.
The application shall be made in the prescribed form and accompanied by the:
(a) supporting documentation, and
(b) prescribed fee that the Authority may determine.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 57C inserted
Related Key Concerns
Plain Language Summary
This provision standardizes fees for cyber hygiene certification services, with the Cyber Security Authority setting the rates. Certified cybersecurity professionals cannot exceed these approved rates and must contribute 30% of their revenue to the cybersecurity fund. Failure to comply results in penalties. The set rates will be reviewed periodically based on industry trends and affordability.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 58B, of
' Standardised, Review and Administration of Fees for Cyber Hygiene Certification Service
57C. (1) A certified cybersecurity professional or practitioner or cybersecurity service provider shall charge a fee for cyber hygiene certification services as determined by the Cyber Security Authority.
A certified cybersecurity professional or practitioner or cybersecurity service provider shall not charge fees exceeding the approved flat rate for cyber hygiene certification services.
A certified cybersecurity professional or practitioner or cybersecurity service provider who fails to comply with subsection (2) shall be liable to pay to the Authority an administrative penalty specified in the Second Schedule (not less than two hundred and fifty penalty units and not more than five thousand penalty units)
30% of the revenue generated by a certified cybersecurity professional or practitioner or cybersecurity service provider under the scheme shall be paid into the cybersecurity fund.
The Cyber Security Authority shall, by notice published in the Gazette, determine the applicable flat rate for cyber hygiene certification services.
The flat rate shall be reviewed periodically based on, industry trends, and the affordability needs of stakeholders.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 58A inserted
Plain Language Summary
This provision requires the Authority to develop a process for certifying the security of innovative and emerging technologies. This mechanism will provide a way to assess and validate the security of these new technologies. The goal is to ensure that these technologies meet certain security standards through a formal certification process.
Show Original Legal Text
The principal enactment is amended by the insertion after section 58, of
58A. The Authority shall establish a mechanism for the certification of the security of innovative and emerging technologies.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 58B inserted
Plain Language Summary
This provision requires the Authority to develop a process for accrediting non-profit organizations that specialize in cybersecurity. This accreditation mechanism aims to establish standards and recognize qualified non-profit cybersecurity institutions. The goal is likely to promote quality and trust within the cybersecurity sector by formally recognizing credible non-profit entities.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 58A, of
'Accreditation of non-profit cybersecurity institutions
- 58B. The Authority shall establish a mechanism for the accreditation of non-profit cybersecurity institutions.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59 of Act 1038 Amended
Related Key Concerns
Plain Language Summary
This provision amends existing law to include the certification of the security of new technologies. The technologies covered include AI, cloud computing, quantum computing, big data, and blockchain. This means that these technologies can be officially certified for their security features.
Show Original Legal Text
- The principal enactment is amended in section 59 by the addition after paragraph (e) of subsection (1), of
'(g) certification of the security of innovative and emerging technologies including Artificial Intelligence, cloud technology, quantum computing, big data, and blockchainbased technology.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59A inserted
Related Key Concerns
Plain Language Summary
This provision establishes enforcement mechanisms for the Act, allowing the Authority to penalize those who violate cybersecurity standards. Penalties range from warnings and cease-and-desist orders to fines, imprisonment, and suspension or termination of licenses. The Authority can pursue criminal or administrative actions, or both, to ensure compliance.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59, of
' Enforcement powers
59A. (1) A person who:
(a) knowingly fails to comply with or acts in contravention of this Act, regulations or directives issued under this Act;
(b) knowingly fails to comply with prescribed cybersecurity standards and requirements;
(c) provides cybersecurity services without a licence or acts as a cybersecurity professional or practitioner without accreditation;
(d) willfully obstructs, hinders, molests or assaults personnel of the Authority duly engaged in the exercise of power conferred on the Authority under this Act.
commits an offence and is liable on summary conviction to a term of imprisonment of not more than five years or to a fine of not more than twenty thousand penalty units, or to both.
Where an offence is committed by a corporate entity, that entity is liable to a fine of not more than twenty thousand penalty units and each director of that entity shall be deemed to have committed the offence.
Despite subsection (1), the Authority may, where a person has breached this Act, Regulations or directives or where a licensee, an accreditation holder has breached a condition contained in its licence or accreditation:
(a) warn the person, licensee, or accreditation holder,
(b) issue a cease-and-desist order,
(c) apply to the High Court for
(i) an injunction to restrain the person, licensee, or accreditation holder from continuing the breach, or
(ii) other appropriate order to enforce compliance with this Act,
(d) propose amendments to the licence or accreditation in accordance with this Act or Regulations
(e) suspend or terminate the licence or accreditation in accordance with this Act, or
(f) impose administrative penalties in accordance with the second schedule of the Act
(g) or take any other action that it considers appropriate and that is not contrary to this Act.
Nothing shall prevent the Authority from pursuing only criminal enforcement actions under subsection (1) or only administration enforcement actions under subsection (2), or a combination of both.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59B inserted
Plain Language Summary
This provision empowers the Authority to investigate and prosecute cybercrimes. It enables the Authority to confiscate assets gained through cybercrime, pursue civil actions for asset recovery, and freeze property related to investigations, subject to court confirmation. This aims to combat cybercrime by allowing for the recovery of ill-gotten gains and preventing further illicit activities.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59A, of
' Power to conduct investigations and to prosecute cybercrime '
59B. (1) The Authority shall upon the occurrence of a cybersecurity incident or a cybercrime conduct criminal investigations and prosecute same.'
The Authority shall have the jurisdiction to prosecute all offences under the Electronic Transactions Act, 2008 (Act 772).
Where a person is convicted of a cybercrime under this Act, the Authority may apply to the Court for an order to confiscate moneys, proceeds, benefits, properties and assets purchased by a person with proceeds derived from or in the commission of the cybercrime.
Despite subsection (5), nothing shall prevent the Authority from instituting a civil action independently or at the same time as the prosecution to recover moneys, proceeds, benefits, properties and assets purchased by a person with proceeds derived from or in the commission of the cybercrime.
In relation to subsection (6) if criminal prosecution fails, civil asset recovery should still proceed, and confiscation orders should have the effect of a civil judgment appealable from the High Court to the Court of Appeal.'.
Where the Authority considers that freezing of property is necessary to facilitate an investigation or prosecution, the Authority shall in writing direct the freezing of:
(a) the property of a person or entity being investigated; or
(b) specified property held by a person or entity other than the person or entity being investigated or prosecuted.
The Authority shall within 14 days after the freezing of the property apply to the Court for a confirmation of the freezing.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59C inserted
Plain Language Summary
This provision empowers the Authority to request information from various parties, including infrastructure owners and service providers, when investigating potential violations. The Authority must provide a written notice detailing the request. If a person is unable to disclose information, the Authority must seek a court order. Failure to comply with a request can result in fines or imprisonment.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59B, of
'Power to request for information
59C. (1) The Authority may, for the purposes of carrying out an investigation in respect of a contravention of the Act, Regulations or any other relevant enactment by the owner of a critical information infrastructure, a licensee, a service provider or any other person, by notice in writing, require a person to:
(a) attend at a time and place specified in the notice; and
(b) furnish the Authority with information related to a matter relevant to the investigation.
A notice under subsection (1) shall indicate the subject matter and purpose of the request.'.
Where a person required to furnish the Authority with an information is under an obligation not to disclose, or asserts a right not to disclose, the Authority shall apply to the High Court for an order for the production of the information.
- Where an information is furnished to the Authority, the Authority shall make copies or extract from the Information and request the person
(5) A person who appears before the Authority may be represented by a Counsel of the choice of that person at any stage of the process.
- Except as provided in subsection (2) where a person contravenes subsection (1) (a) and (b), that person commits an offence and is liable on summary conviction to a fine of not less than two hundred and fifty penalty units and not more than ten thousand penalty units or to a term of imprisonment of not less than one year and not more than two years or to both.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59D inserted
Plain Language Summary
This provision allows investigative officers to apply to the High Court for an order to obtain specific computer data needed for a criminal investigation. The officer must show reasonable cause and explain the need for the data, the type of data sought, and the measures taken to protect unrelated information. This order compels a person in control of a computer system to submit the specified data to the investigative officer.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59C, of
' Application for Production Order to Collect Computer Data
59D. (1) An investigative officer may apply ex-parte to the High Court for a production order to collect computer data.
A production order under section (1) shall require a person in possession or control of a computer or computer system to submit specified computer data which is stored in the computer or computer system to the investigative officer.
An investigative officer who makes an application under section (1) shall demonstrate to the satisfaction of the Court that there are reasonable grounds to believe that the computer data is reasonably required for the purposes of a specific criminal investigation.
Where an investigative officer makes an application under section (1), that investigative officer shall:
(a) explain why the investigative officer believes the computer data sought, will be available to the person in control of the computer or computer system;
(b) identify and explain with specificity the type of computer data suspected to be found on the computer or computer system;
(c) identify and explain with specificity the computer data that may be found on a computer or computer system that is the subject of an investigation or prosecution;
(d) identify and explain with specificity the offences in respect of which the production order is sought; and
(e) indicate what measures shall be taken to ensure that the computer data will be procured
- (ii) without the disclosure of the computer data of any party not part of the investigation.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59E inserted
Plain Language Summary
This section allows the High Court to order service providers to hand over data for criminal investigations. The court can only grant the order if the request is necessary and proportionate, and if privacy measures are in place to protect others. Service providers must keep the order and its execution confidential.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59D, of
'Grant of production order
59E. (1) The High Court may grant an application for a production order under subsection (1) of section 59D, if the Court is satisfied that
(a) the investigative officer has complied with subsection (3) and (4) of section 59D;
(b) the information requested is commensurate, proportionate and necessary for the purposes of a specific criminal investigation or prosecution;
(c) measures shall be taken to ensure that the computer data is produced whilst maintaining the privacy of other users, customers and third parties and without the disclosure of information and data of any party not part of the investigation; and
(d) the investigation may be frustrated or seriously prejudiced unless the production of the information is permitted.
The Court shall require the service provider to keep confidential the production order and the execution of the production order under this section.
A production order granted under this Act shall be served on a domestic service provider, foreign service provider or both, or any other relevant person.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59F inserted
Plain Language Summary
This provision allows investigative officers to apply for a warrant from the High Court to access, search, and seize computer data or systems relevant to a criminal investigation. The warrant can compel knowledgeable individuals to provide information to assist the investigation. The officer must demonstrate reasonable grounds for needing the warrant, which can be extended to other computer systems if necessary.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59E, of
' Application for Warrant to Access, Search and Seize Computer Data, Computer or Computer System
59F. (1) An investigative officer may apply ex-parte to the High Court for a warrant to:
(a) access data on a computer or computer system;
(b) search and seize a computer or a computer system; or
(c) make or retain a copy of computer data on a computer or computer system;
(d) maintain the integrity of computer data on a computer or computer system;
(e) remove or render inaccessible computer data on a computer or computer system
that is suspected to contain information relevant to an investigation.
A warrant under subsection (1) shall require a person who has knowledge about the functioning of the computer or computer system to provide the necessary information to enable an investigative officer undertake the actions required under paragraphs (a) to (e) of subsection (1).
An investigative officer who makes an application under subsection (1) shall demonstrate to the satisfaction of the court that there are reasonable grounds to believe that the warrant is reasonably required for the purposes of a specific criminal investigation.
A warrant under subsection (1) shall permit a law enforcement officer to expeditiously extend the search for data from a computer or computer system to another computer or computer system or part of it in Ghana where the law enforcement officer has reasonable grounds to believe that the data sought is accessible from or available to that other computer or computer system or part of it in Ghana.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59G inserted
Plain Language Summary
This section allows the High Court to issue warrants for computer data if certain conditions are met. These conditions include ensuring the request is proportionate to the investigation, protecting the privacy of uninvolved parties, and demonstrating that the investigation would be significantly hampered without the data. Service providers receiving such warrants must keep them confidential. This process enables law enforcement to access necessary digital information while aiming to safeguard individual privacy.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59F, of
' Grant of warrant
59G. (1) The High Court may grant an application for a warrant under subsection 1 of section 59F if the Court is satisfied that
(a) the investigative officer has complied with subsection (3) of section 59F.
(b) the information requested is commensurate, proportionate and necessary for the purposes of a specific criminal investigation or prosecution;
(c) measures shall be taken to ensure that the computer data is produced whilst maintaining the privacy of other users, customers and third parties and without the disclosure of information and data of any party not part of the investigation; and
(d) the investigation may be frustrated or seriously prejudiced unless the production of the information is permitted.
The Court shall require the service provider to keep confidential the warrant and the execution of the warrant under this section.
A warrant granted under this section shall be served on a domestic service provider, foreign service provider or both, or any other relevant person.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59H inserted
Plain Language Summary
This provision allows law enforcement to request that service providers preserve computer data while seeking a court order. Service providers must comply for 14 days, after which they are no longer obligated if a court order isn't received. Investigative officers can apply to a court for an order to preserve specific computer data if it's vulnerable to being lost or changed. This ensures that potential evidence is protected during investigations.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59G, of
' Application for preservation order to preserve computer data
A provider of wire or electronic communication services or a remote computing service on the written request of a law enforcement agency, shall take the necessary steps to preserve records and other evidence in its possession pending the issue of a Court order and shall take steps to ensure that the request by the law enforcement agency is not disclosed to third parties during the period.
Where an order from the Court is not obtained and served for fourteen days after the receipt of the written request, the wire or electronic communication services, or remote computing service provider is not under any obligation to preserve the evidence.
An investigative officer authorised by a designated officer may apply ex-parte to the Court for an order to require a service provider or any person in control of a computer or computer system to preserve specified computer data, including traffic data that has been stored by a computer system.
An investigative officer who makes an application under subsection (1) shall demonstrate to the satisfaction of the Court that the computer data is particularly vulnerable to loss or modification.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59I
Plain Language Summary
This section allows the High Court to issue preservation orders for computer data if certain conditions are met, including compliance with procedures, proportionality to the investigation, and protection of privacy. These orders, initially valid for 90 days, can be renewed once. Service providers must keep these orders confidential.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59H, of
' Grant of preservation order
59I. (1) The High Court may grant an application for a preservation order under subsection (1) of section 59F if the Court is satisfied that:
(a) the designated officer has complied with subsection (2) of section 59H;
(b) the extent of the preservation order is commensurate, proportionate and necessary for the purposes of a specific criminal investigation or prosecution;
(c) measures shall be taken to ensure that the computer data is preserved whilst maintaining the privacy of other users, customers and third parties and without the disclosure of information and data of any party not part of the investigation; and
(d) the investigation may be frustrated or seriously prejudiced unless the preservation order is permitted.
The preservation order issued under subsection (1)
(a) is valid for a period of ninety days, and
(b) may be renewed for a further period of ninety days upon application to the Court.
The Court shall require the service provider to keep confidential a preservation order issued under this regulation.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59J
Plain Language Summary
This section allows designated inspectors to enter and inspect premises (excluding homes) to ensure compliance with the Act and its regulations. Inspectors can obtain warrants or, with reasonable cause and prior notice, enter without one. During inspections, they can examine documents, equipment, and request relevant information from individuals on the premises.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59I, of
'Power of entry, inspection and audit
59J. (1) The Authority may designate a person as an inspector to inspect premises.
A person designated as an inspector by the Authority may
(a) obtain a warrant to:
(i) enter and inspect premises; and
(ii) conduct an audit of a computer system
(b) at any reasonable time, enter inspect premises and conduct and audit of a computer system without a warrant where the inspector
(i) reasonably believes that an inspection of the premises is necessary to ensure compliance by the owner of a critical information infrastructure, a licensee or a service provider or any other relevant person with the Act or Regulations; and
(ii) has given the occupier of the premises seven days' notice in writing of the intention to enter, inspect the premises and conduct an audit of a computer system.
An inspector shall, before exercising a power of entry and inspection,
(a) produce evidence of the identity of the inspector; and
(b) indicate the purpose of entry and inspection.
An inspector may
(a) enter a premises;
(b) inspect the premises;
(c) inspect a document or equipment found on the premises;
(d) require a person on the premises to provide any information, or produce any document in the possession or control of that person that the inspector considers relevant to ensure compliance with the Act and Regulation and
(e) require any person on the premises to provide information in respect of a document or the location of a document.
For the purpose of this regulation, 'premises' does not include domestic premises.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 59K inserted
Plain Language Summary
This provision protects witnesses and informants who report cybercrimes or administrative infractions by keeping their personal information confidential unless they consent to its release. The Authority must keep the informant's identity secret and take steps to ensure their safety and welfare. This protection extends to people related to the witness or informant.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 59J, of
'Witness and Informant Protection
59K. (1) Except with the written, informed, explicit and freely given consent of a witness or informant, no witness or informant who discloses information relating to cybercrime under this Act or administrative infractions under this Act, shall be obliged to disclose his name or address or other personal information, or state any matter which might lead to their discovery.
(2) Unless otherwise provided, the information and the identity of the witness or informant shall be held to be secret between the Authority and the witness or informer; and all matters relating to such information should be privileged and shall not be disclosed in any proceedings before any court, tribunal, commission, or authority.
- The Authority take all necessary and reasonable steps to protect the safety and welfare of a witness or informant, and such the protection shall extend to persons by virtue of being related to a witness or informant, or on account of a testimony given by a witness or informer, or for any other reason upon which the Authority may consider sufficient.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 67 of Act 1038 amended
Plain Language Summary
This amendment broadens the scope of Section 67 from online sexual offenses to include other cybercrimes. It also updates the penalties for violating the section. Individuals convicted now face imprisonment from 3 to 10 years, a fine ranging from 250 to 25,000 penalty units, or both.
Show Original Legal Text
- The principal enactment is amended by:
'Other cybercrime'.
(b) the substitution for subsection (2) of section 67, of
'(2) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a term of imprisonment of not less than three years and not more than ten years or a fine of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units or to both.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 67A inserted
Related Key Concerns
Plain Language Summary
This provision makes cyberbullying and online harassment illegal. It prohibits various online behaviors like sending threatening messages, creating fake profiles to harass someone, tracking people without their consent, and spreading false information. Service providers are required to protect children from online violence. Violators could face fines and jail time.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 67, of
' Cyberbullying and online harassment
67A. (1) A person shall not use the internet or any form of electronic medium or technology to bully a child or an adult.
A person shall not use a computer or any other electronic medium to
(a) send a threatening message or a lewd message to a child;
(b) make sexual advances towards a child; or
(c) persistently make contact with
(i) a child, whether or not the contact is acceptable; or
(ii) another person where the contact is unacceptable.
A person shall not create a false identity online or a fake social media profile for the purposes of following
(a) a child, whether or not the contact is acceptable; or
(b) an adult, where the contact is unacceptable.
A person shall not use any online computer service or any other electronic device to:
(a) track the location of a child;
(b) monitor the real-world activities of a child;
(c) track the location of another person without the consent of that person;
(e) obsessively track the location of
(i) a child; or
(ii) another person without the consent of that person.
Despite subsection (4), a parent or legal guardian may for the purposes of ensuring the safety of a child, track the location of the child, or monitor the real-world activities of the child.
A person shall not use an electronic device or medium to send
(a) an unwanted,
(b) an unsolicited,
(c) a frightening,
(d) an obscene,
(e) a harassing, or
(f) a threatening electronic mail, text message or instant message to a child or an adult.
A service provider of a user-to-user service including
(a) a chatroom,
(b) a social network site,
(c) an online gaming platform, or
(d) a virtual, augmented and mixed reality shall protect a child from all forms of online violence and cyberbullying from users of the userto-user service.
A person shall not use an electronic device or an electronic medium to deliberately spread false or misleading information with the intent to deceive or manipulate a person or a fact.
A person who contravenes subsections (1), (2), (3), (4) or (6) commits an offence and is liable on summary conviction to a fine of not less than two thousand, five hundred penalty units and not more than five thousand penalty units or to a term of imprisonment of not less than one year and not more than three years or to both.
For the purpose of this Act, 'cyberbullying' includes any digital communication and any other activity which strips the recipient of the dignity of the recipient, or causes fear or physical or emotional harm such as
(a) repeatedly sending offensive, rude and insulting messages to a person;
(b) distributing derogatory information about a child or any other person;
(c) posting or sending offensive photos of a child or any other person, whether or not the photos
(i) have been digitally altered, or
(ii) were taken with the consent of the victim, with the intention to humiliate or embarrass the victim;
- (d) breaking into an electronic mail, social networking or any electronic account and using the virtual identity of a victim to send, upload or distribute embarrassing materials to or about others; - (e) sharing sensitive personal information or any embarrassing information, or tricking a child or any person to reveal personal or embarrassing information about that child or any other person and sharing the information obtained with others; - (f) repeatedly sending threatening or intimidating messages with threats of harm, or engaging in online activities that cause fear in a child or puts any other person in fear; - (g) sending messages to another person telling the person to commit suicide; - (h) sending grossly offensive, indecent or obscene communication with the intention of causing emotional distress to a child or any other person; or - (i) sending electronic messages that denigrate a child or any other person on the basis of(i) colour;
- (iii) ethnic or national origins; - (iv) religion; - (v) gender; or - (vi) disability.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 67B inserted
Related Key Concerns
Plain Language Summary
This provision makes cyberstalking a crime. It prohibits using online platforms to harass or stalk someone, create fake information about them, or spread false information. Violators could face imprisonment between one and ten years, a fine, or both. This aims to protect individuals from online harassment and stalking.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 67A, of
' Cyberstalking of a person
' 67B. (1) In furtherance of section 65 of the Act, a person shall not use the internet, chatroom, a social network site, an online gaming platform, or a virtual, augmented and mixed reality to
(a) harass or stalk a person;
(b) assume a false identity to anonymously harass or stalk a person;
(c) create false information about a person; or
(d) post or disseminate false information about a person.
A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a term of imprisonment of not less than one year and not more than ten years or a fine of less than one hundred penalty units and not more than ten thousand penalty units or to both.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 68 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This amendment changes the penalty for violating a specific rule outlined in subsection (1) of section 68. The new penalty includes imprisonment ranging from 3 to 10 years, a fine between 250 and 25,000 penalty units, or both. This means individuals who break the rule in subsection (1) could face stricter consequences.
Show Original Legal Text
The principal enactment is amended in section 68 by substitution for subsection (2), of
'(2) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a term of imprisonment of not less than three years and not more than ten years or a fine of less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units or to both.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 83 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This section modifies existing law to allow for quicker access to stored computer data held by service providers during emergencies. It permits authorities to request this data without going through the usual process of seeking mutual assistance. An emergency is defined as a situation where there is an immediate and significant threat to someone's life or safety. The changes also cover requests for domain name registration information and other related issues.
Show Original Legal Text
The principal enactment is amended in section 83 by:
(a) the substitution for paragraph (e) of subsection (4), of
- '(e) requesting for information regarding domain name registration;'.
(b) the addition after paragraph (e) of subsection (4), of
- '(f) expedited disclosure of specified stored computer data in a service provider's possession or control in an emergency situation without a request for mutual assistance;'.
(c) the addition after paragraph (f) of subsection (4), of
- '(g) any other matter related to paragraphs (a) to (f).'.
(d) the addition after paragraph (g) of subsection (4), of
'(5) For the purpose of this section an emergency means, a situation in which there is a significant and imminent risk to the life or safety of any natural person.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 90 of Act 1038 amended
Plain Language Summary
This amendment clarifies that the Circuit Court has the authority to hear cases involving offenses described in sections 62 to 68A of the act. This means that these specific cases can be tried in the Circuit Court. The change overrides any potential conflicting interpretations from other sections of the act regarding jurisdiction.
Show Original Legal Text
The principal enactment is amended in section 90 by the addition after subsection (2), of
'(3) Despite section 90(1) and section 90A, the Circuit Court shall have the jurisdiction to try an offence under sections 62 to 68A of this Act.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 91 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This provision expands the scope of section 91 to include new areas related to cybersecurity. It focuses on designating and accrediting cybersecurity teams and institutions, protecting children online, and ensuring the security of new technologies. The changes also address the licensing and accreditation of cybersecurity professionals and service providers to enhance overall cybersecurity efforts.
Show Original Legal Text
The principal enactment is amended in section 91 by the addition after paragraph (h), of
'(i) the designation of Sectoral Computer Emergency Response Team;
(j) the accreditation of Sectoral Computer Emergency Response Team;
(k) the accreditation of cybersecurity establishments;
(l) the accreditation of non-profit cybersecurity institution;
(m) the protection of children;
(n) safeguarding the development and deployment of innovative and emerging technologies or solutions;
(o) licensing of cyber security service providers;
(p) accreditation of cybersecurity professionals and practitioners;
(p) any other matter required for ensuring the cybersecurity of the country.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 92 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This section modifies the powers of the Authority to issue directives related to cybersecurity. It expands the scope of entities to which the Authority can issue directives, including innovators and developers. It also specifies that failure to comply with these directives can result in administrative penalties. Finally, it empowers the Authority to issue directives to secure the adoption of new technologies.
Show Original Legal Text
The principal enactment is amended in section 92 by:
- (a) the substitution for subsection (1), of
'(1) the Authority may issue directives to an owner of a critical information infrastructure, a cybersecurity service provider or service provider, innovators, developers for the purpose of ensuring the cybersecurity of the country.
(b) the substitution for subsection (2), of
(c) the insertion after subsection (2), of
'(3) The Authority may issue directives to innovators, developers, service providers and cybersecurity service providers for the purpose of securing the adoption and deployment of innovative and emerging technologies or solutions.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 94 of Act 1038 amended
Related Key Concerns
Plain Language Summary
This section makes it a crime to access private digital information like subscriber details or intercept data without permission. It also prohibits attempts to access or damage critical computer systems. Violators could face significant fines (between 2,500 to 25,000 penalty units) and/or prison sentences (between 2 to 5 years).
Show Original Legal Text
The principal enactment is amended by the substitution for section 94, of
'(1) A person who, without lawful authority accesses or retrieves subscriber information or intercepts traffic data or content data, commits an offence and is liable on summary conviction to a fine of not less than two thousand five hundred penalty units and not more than fifteen thousand penalty units or to a term of imprisonment of not less than two years and not more than five years or, to both.
An attempt to gain access to a critical information infrastructure or its dependencies, successful or not, constitutes an unlawful access to the critical information infrastructure.
Any person who attempts to secure access to a critical information infrastructure or its dependencies, successful or not commits an offence and is liable on summary conviction to a term of imprisonment of not less than two years and not more than five years or a fine of not less than four thousand penalty units and not more than twenty-five thousand penalty units or to both.
The tampering and or destruction of critical information infrastructure or its components which affects the confidentiality, integrity or availability of the critical information infrastructure constitutes unlawful access to critical information infrastructure, and a person shall be subject to the same criminal penalties specified in subsection (1).'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 94A inserted
Plain Language Summary
This provision makes it illegal to intentionally alter computer data to create fake information for legal use. This includes inputting, changing, deleting, or suppressing data to make it seem authentic. Those who violate this law will be prosecuted for forgery under existing criminal laws and face similar penalties.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 94, of
' Computer related Forgery
95A. (1) A person shall not intentionally and without right, input, alter, delete or suppress computer data resulting in inauthentic data with the intent that they be considered or acted upon for legal purposes as if they were authentic, regardless of whether or not the data are directly readable and intelligible.'
A person who contravenes subsection (1) commits an offence and shall be deemed to have committed the offence of forgery under Chapter Two of the
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 94B inserted
Plain Language Summary
This provision makes it illegal to intentionally cause someone to lose property through computer-related fraud, such as manipulating data or interfering with computer systems. This includes using computers to deceive someone into doing something that results in property loss. Those who commit computer-related fraud will face the same penalties as those who commit fraud by false pretense under existing criminal law.
Show Original Legal Text
- The principal enactment is amended by the insertion after section 94A, of
'Computer related Fraud
95B. (1) A person shall not intentionally and without right, cause the loss of property to another person by means of:
(a) Any input, alteration, deletion or suppression of computer data;
(b) Any interference with the functioning of a computer system;
(c) Any deception as to factual circumstances made through a computer system that causes a person to do or omit to do anything which that person would not otherwise do or omit to do; with the fraudulent or dishonest intent of procuring for oneself or for another person, without right, a gain in money or other property.
A person who contravenes subsection (1) commits an offence and shall be deemed to have committed the offence of defrauding by false pretence under section 131 of the Criminal Offences Act, 1960 (Act 29), and shall liable on summary conviction to the same punishment for defrauding by false pretence under that law.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 97 of Act 1038 amended
Plain Language Summary
This section updates the definitions used in Act 1038 to include modern technologies and legal terms. It defines terms like artificial intelligence, blockchain, big data, cloud technology, and digital services. It also clarifies the meaning of legal terms such as confiscation, freezing, seizure, and property within the context of the act.
Show Original Legal Text
The principal enactment is amended in section 97 by:
(a) the insertion before 'Authority', of
'Artificial Intelligence is technology that enables computers and machines to simulate human learning, comprehension, problem solving, decision-making, creativity and autonomy;';
'block-chain based technology' means an advanced decentralised digital record or digital ledger of transactions, that enables recording of transactions, tracking of assets, and sharing of records across computer networks in a transparent and immutable way;'.
'big data' means a collection of extremely large organized, semi-structured, and unstructured information that grows exponentially over time;';
(b)
- the insertion after 'child', of 'cloud technology' means technology that delivers computing services and offers on-demand access to computing resources such as physical or virtual services, data storage, servers, databases, networking, intelligence, analytics, and software over the
internet;';
- (c) the insertion after 'cloud technology', of
'confiscation', which includes forfeiture where applicable, shall mean the permanent deprivation of property by order of a court or other competent authority;';
(d) the insertion after 'digital ecosystem' of
'digital services' means services delivered electronically whether traditionally or by internet, with minimal physical interaction, and includes:
(a) social media platforms;
(b) e-commerce platforms;
(c) video-on-demand or streaming platforms;
(d) messaging applications,
(e) fintech software platforms;
(f) online banking platforms;
(e) the insertion after 'Director-General', of
'Emergency' shall mean a situation in which there is a significant and imminent risk to the life or safety of any natural person;';
(f) the insertion after 'e-services', of
'Freezing' or 'seizure' mean temporarily prohibiting the transfer, conversion, disposition or movement of property or temporarily assuming custody or control of property on the basis of an order issued by a court or other competent authority;';
(g) the insertion after 'interception of warrant', of
'Internet of Things (IoT) means a network of interrelated physical devices, vehicles, appliances and other physical objects that connect and exchange data with other devices and the cloud across wireless networks, and are typically embedded with sensors, processing ability and software and can include mechanical and digital machines and consumer objects;';
(h) the substitution for 'computer system', of
'computer system' means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes
(a) an information processing system;
(b) an operational technology system, a programmable logic controller, a supervisory control and data acquisition system, or a distributed control system; and
(c) dependency systems that support the functionality of a computer or computer network;';
(i) the substitution for 'law enforcement agency', of
'law enforcement agency' means
(a) The Police
(b) The Customs Division of the Ghana Revenue Authority and
(c) Cyber Security Authority
(d) Any other agency authorised by law to exercise the powers of the Police
(j)
- the insertion after 'prohibited intimate image and visual recording', of
'property' means assets of every kind, in the country or elsewhere whether corporeal or incorporeal, movable or immovable, tangible or intangible, including virtual assets, and legal documents or instruments evidencing title to, or interest in, such property assets;';
- (k) the insertion after 'property', of
'property of or in the possession or control of a person' includes a gift made by that person;
- (l) the insertion after 'publish', of
'quantum computing' means technology that solves complex problems based on principles of quantum mechanics;'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 98 of Act 1058 amended
Plain Language Summary
This provision repeals and replaces several sections of the Electronic Transaction Act of 2008. Specifically, it repeals sections 118, 136, and sections 55-62 of the previous act, replacing the latter with sections 35-40 of the current act. Any existing rules or actions taken under the repealed sections will remain valid.
Show Original Legal Text
- The principal enactment is amended by substitution for section 98, of
' Repeals and savings
Sections 118 and 136 of the Electronic Transaction Act, 2008 (Act 772) are repealed.
Sections 35 to 40 this Act repeals sections 55 to 62 of the Electronic Transaction Act, 2008 (Act 772).
Despite the repeal of sections, any Regulations, bye-laws, directives, notices, orders, directions, appointments or other acts lawfully made or done under the repealed enactment and in force immediately before the
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Section 99 of Act 1038 amended
Plain Language Summary
This provision modifies Ghana's extradition laws to facilitate the extradition of individuals accused of cybercrimes. It allows extradition to countries that are signatories to the Budapest Convention on Cybercrime or similar conventions, even if Ghana doesn't have a separate extradition agreement with them. In these situations, the extradition process will follow the rules outlined in the relevant international convention.
Show Original Legal Text
The Extradition Act, 1960 (Act 22) is amended by:
(a) the addition after subsection (3) of section, of
'(4) Despite subsection (1), for the purposes of extradition, Cybercrime and Cyber Offences under the First Schedule to this Act, in the absence of a separate arrangement, bilateral or multilateral agreement between Ghana and another signatory of the Budapest Convention on Cybercrime or any other convention, extradition of fugitive criminals may still take place between Ghana and another signatory of the Budapest Convention on Cybercrime or any other convention and shall be governed by the provisions of the said convention.'.
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Second schedule to Act 1038 amended
Plain Language Summary
This provision modifies the penalties for violating the Cybersecurity Act, specifically for owners of critical information infrastructure. It introduces fines for failing to register infrastructure, report ownership changes, or inform authorities about cybersecurity incidents. Penalties are also specified for not conducting audits or complying with directives from the relevant authority.
Show Original Legal Text
- The principal enactment is amended by substitution for administrative penalties for sections 36(4), 39(2)(a), 39(2)(b), 39(2)(c) and 92(2) and addition of administrative penalties for sections 36(1) and 39(3)(c).
| No. | Sections of Act creating contravention | Contravention | Administrative Penalty |
|---|---|---|---|
| 1. | 36(1) | The Owner of the designated critical information infrastructure shall register their critical information infrastructure with the Authority, and shall pay the prescribed annual registration and designation fee as determined by the Authority or stipulated in a legislative instrument. | Not less than five thousand penalty units, not more than fifty thousand penalty units. |
| 2. | 36(4) | Owner of a registered critical information infrastructure failing to inform the Authority within seven days of the change in legal ownership of the registered critical | Not less than five thousand penalty units, not more than |
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Third schedule to Act 1038 amended
Plain Language Summary
This provision adds the "Official Oath" to Act 1038. This oath is taken by individuals holding official positions in Ghana. By taking this oath, they pledge to serve Ghana faithfully and uphold the country's constitution.
Show Original Legal Text
50. The principal enactment is amended by addition after the 'Oath of Secrecy', of
The Official Oath (section 5)
I,
……………………………………………………………..……………………………
do (in the name of the Almighty God swear) (solemnly affirm) that I will at all times well and truly serve the Republic of Ghana in the office of …….and that I will uphold, preserve, protect and defend the constitution of the Republic of Ghana as by law established (so help me God).
Note: This text is extracted from the PDF and may contain formatting errors or inaccuracies. For full accuracy, please refer to the official PDF document.
Take Action
Your Voice Matters
Public submissions are being accepted until 14 November 2025
Download the Draft Bill (PDF) and the Format for Submitting Comments from the CSA website. Submit your feedback to submit.feedback@csa.gov.gh in accordance with the specified format. All stakeholders, including Cybersecurity Professionals, Cybersecurity Service Providers, Civil Society Organisations, and the General Public, are encouraged to provide feedback.