Distributes a software product, in Ghana

Cybersecurity Act, 2020 (Act 1038), s. 59, and Second Schedule item 59(4) · Read the law's page

• This binds the public and private sectors generally in Ghana; the Act states no size or sector gate for this duty.
• Comply with the cybersecurity standards the Cyber Security Authority develops, establishes, adopts and publishes on its website, which by section 59(1) cover education and skills development, hardware and software engineering, governance and risk management, research and development, and any other area the Authority determines in line with international best practice.
• Breaching an adopted standard is an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units, payable to the Cyber Security Authority.

Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) · Read the law's page

• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.
• Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.
• Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
• This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.

Cybersecurity Act, 2020 (Act 1038), ss. 49-53, First Schedule, and Second Schedule items 49(2) and 51(5) · Read the law's page

• This binds a person who provides a cybersecurity service for reward in Ghana, a term the First Schedule defines to include designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within it even without performing penetration testing, forensic examination, monitoring or any of the Schedule's other listed services; a general-purpose software product with no security-specific function is not reached by this term on its own.
• Obtain a licence from the Cyber Security Authority before providing the cybersecurity service; the Authority acknowledges an application within fourteen days and decides it within thirty days.
• A granted licence is valid for two years from the date it is granted; apply in writing for renewal not later than one month before it expires.
• Do not transfer the licence to another person and do not use it for a purpose other than the one for which it was granted.
• Providing a cybersecurity service without a licence is an administrative penalty equal to the cost of the damage caused and the value of the financial gain made, not a fixed sum; transferring a granted licence is a separate criminal offence carrying a fine of not less than five thousand penalty units and not more than ten thousand penalty units or imprisonment of not less than six months and not more than two years, or both; a licensed service provider using a licence for a purpose other than the one for which it was granted is liable to an administrative penalty of fifty thousand penalty units.