GhanaCybersecurity Act, Unlawful Access
Cybersecurity Act, 2020 (Act 1038), s. 94 (Unlawful Access)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction, Security
- Audit expectation
- none
What it requires
- Do not, without lawful authority, retrieve a person's subscriber information or intercept traffic data or content data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unlawful access under section 94 carries a fine of not less than two thousand five hundred penalty units and not more than fifteen thousand penalty units, or imprisonment of not less than two years and not more than five years, or both.
Penalty structure
Section 94 sets a fine of not less than two thousand five hundred penalty units and not more than fifteen thousand penalty units. One penalty unit equals twelve Ghana cedis under the Fines (Penalty Units) Act, 2000 (Act 572), as recorded by the Ghana Revenue Authority, making the ceiling one hundred eighty thousand Ghana cedis.
- Rule
- Fixed only
- As of
- Currency
- GHS
- Fixed cap
- 15,000
Who enforces it
Enforcement body
Cyber Security Authority; prosecuted before the High Court
Settledness
- As of
- Open questions
- Does "subscriber information", which the Cybersecurity Act, 2020 defines as information "held by a service provider, relating to subscribers of the services of a service provider", include profile data that a platform shows to every visitor, so that retrieving it from the platform's public pages is retrieval "without lawful authority" under section 94?
- Does gathering users' public posts from a platform's pages amount to intercepting "content data" under section 94, which the Act defines as "the communication content of the communication", or does the offence require capture of a communication in transit?
What it makes you log
Logging duty
Section 94 makes it an offence to retrieve subscriber information or intercept traffic data or content data without lawful authority, with a fine and imprisonment of two to five years. It imposes no duty to make, keep, produce or review a log or record. Section 77 requires a service provider to retain subscriber information, traffic data and content data for stated periods, but it is a separate duty in a section this row does not cite and is not read into it. Section 90 gives the High Court jurisdiction to try offences under the Act and states no territorial reach, so the hook is left empty.
- Kind
- None
- As of
What this law does
Section 94 punishes a person who, without lawful authority, retrieves subscriber information or intercepts traffic data or content data. This offence is narrower than the Electronic Transactions Act's general unauthorized-access offences: it binds a person dealing in communications data held by or passing through a service provider, rather than a general web crawler collecting data from public pages it does not own.
The Act also imposes retention and cooperation duties on a service provider, and creates a licensing regime for cybersecurity service providers, enforced by the Cyber Security Authority.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .