GhanaCybersecurity Act, Duty to Report Cybersecurity Incident
Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
What it requires
- This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.
- Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.NIST CSF 2.0RS.CO-02
- Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.NIST CSF 2.0GV.OC-03
- Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Failing to report a cybersecurity incident under section 47(5) is enforced only as an administrative penalty under section 47(6) and the Second Schedule; no provision reviewed here makes that failure, standing alone, a criminal offence.
Who enforces it
Enforcement body
The Cyber Security Authority, established under section 2 of the Cybersecurity Act, 2020 (Act 1038).
Settledness
- As of
- Open questions
- Does the twenty-four-hour clock in section 47(5) run from when the institution itself detects the incident, or from when the relevant Computer Emergency Response Team is told, given the Act does not define the moment of detection?
What this law does
The person in charge of any institution, public or private, must report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where no Sectoral team covers that institution, within twenty-four hours after the incident is detected.
A cybersecurity service provider licensed by the Cyber Security Authority carries a further duty to submit a periodic report on its own operations, including any cybersecurity incident, within a period the Authority determines. Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Authority, rather than a criminal offence.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .