GhanaCybersecurity Act, Critical Information Infrastructure Owner's Incident Report
Cybersecurity Act, 2020 (Act 1038), s. 39(1)(a), and Second Schedule item 39(2)(a)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds the owner of a computer system or computer network designated as a critical information infrastructure by the Minister under section 35 (reached by declaring that you operate an essential service).
- Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the infrastructure does not belong to a Sectoral Computer Emergency Response Team, within twenty-four hours after the incident is detected (section 39(1)(a)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Failing to report a cybersecurity incident under section 39(1)(a) is enforced only by an administrative penalty under section 39(2) and the Second Schedule; the Act makes no criminal offence of that failure.
Who enforces it
Enforcement body
The Cyber Security Authority, established under section 2 of the Cybersecurity Act, 2020 (Act 1038).
Settledness
- As of
- Open questions
- Does the twenty-four-hour clock in section 39(1)(a) run from when the owner itself detects the incident, given the Act does not define the moment of detection?
What this law does
The owner of a critical information infrastructure must report a cybersecurity incident within twenty-four hours after the incident is detected to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the infrastructure does not belong to a Sectoral Computer Emergency Response Team.
The Act defines a cybersecurity incident as any act or attempt, successful or unsuccessful, to gain unauthorised access to, disrupt or misuse an information system or information stored on such information system. Failing to report is an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.
When LexLint raises it
When your app profile says your app runs an essential service.