Is a listed company, in Ghana

Data Protection Act, 2012 (Act 843), ss. 43, 75-81, 88-89 and 95 (enforcement, offences and penalties) · Read the law's page

• Comply with an enforcement notice the Commission serves within the time it states and, where the notice so requires, rectify, block, erase or destroy other data you hold that contains an expression of opinion which appears to the Commission to be based on inaccurate data.
• Notify a third party to whom you disclosed personal data of its rectification, blocking, erasure or destruction where the Commission requires it, either because an enforcement notice requires you to rectify, block, erase or destroy the data or because the Commission is satisfied the data was processed in contravention of a data protection principle.
• Expect a data subject to seek compensation from you for damage or distress your contravention of the Act caused, unless you can prove you took reasonable care to comply.
• Do not purchase, knowingly obtain, or knowingly or recklessly disclose another person's personal data, and do not sell or offer to sell personal data.
• Comply with an information notice or enforcement notice the Commission issues after assessing a data subject's complaint about your processing.

Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) · Read the law's page

• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.
• Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.
• Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
• This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.