Provides telecom services, in Ghana

National Identity Register Regulations, 2012 (L.I. 2111), regs. 7-9 and 13-18 (mandatory use, verification and user agencies) · Read the law's page

• Demand the presentation of a national identity card from the individual concerned before you provide a service in a transaction listed in regulation 7(1), which includes opening individual or personal bank accounts, purchase of insurance policies, consumer credit transactions, registration of SIM cards and applications for public or government services, or in a transaction the Authority publishes in the Gazette under regulation 7(1)(n).
• If you are a user agency, state the purpose for which you require an individual's personal information and satisfy the Authority that the individual is aware of and has authorised the request before you access it.
• If you are a user agency that uses personal information for administrative purposes, retain it only for the period the Authority determines under its guidelines or as specified in the Data Sharing Agreement Form.
• If you are a user agency that obtains personal information, secure and store it in accordance with the Authority's guidelines or as specified in the Data Sharing Agreement.

Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) · Read the law's page

• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.
• Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.
• Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
• This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.