GhanaCybersecurity Act, Licensing of Cybersecurity Service Providers
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Licensing
What it requires
- This binds a person who provides a cybersecurity service for reward in Ghana, a term the First Schedule defines to include designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within it even without performing penetration testing, forensic examination, monitoring or any of the Schedule's other listed services; a general-purpose software product with no security-specific function is not reached by this term on its own.
- Obtain a licence from the Cyber Security Authority before providing the cybersecurity service; the Authority acknowledges an application within fourteen days and decides it within thirty days.
- A granted licence is valid for two years from the date it is granted; apply in writing for renewal not later than one month before it expires.
- Do not transfer the licence to another person and do not use it for a purpose other than the one for which it was granted.
- Providing a cybersecurity service without a licence is an administrative penalty equal to the cost of the damage caused and the value of the financial gain made, not a fixed sum; transferring a granted licence is a separate criminal offence carrying a fine of not less than five thousand penalty units and not more than ten thousand penalty units or imprisonment of not less than six months and not more than two years, or both.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Providing a cybersecurity service without a licence (s. 49(2)) is enforced only as an administrative penalty equal to the cost of the damage caused and the value of the financial gain made. Transferring a granted licence to another person (s. 52(2)) is a separate criminal offence, a fine of not less than five thousand penalty units and not more than ten thousand penalty units or imprisonment of not less than six months and not more than two years, or both.
Who enforces it
Enforcement body
The Cyber Security Authority, with a right of review to the Minister and then to a court of competent jurisdiction over a decision on a licence.
Settledness
- As of
- Open questions
- Because a cybersecurity solution is not itself defined in the Act's interpretation section, does a vendor selling a general-purpose software product with some security feature fall inside the licensing duty, or only a vendor whose product is marketed specifically as a security tool?
What this law does
A person may not provide a cybersecurity service in Ghana without a licence issued by the Cyber Security Authority. The First Schedule defines a cybersecurity service as one provided for reward and aimed at ensuring or safeguarding the cybersecurity of a computer or computer system.
Its list runs from penetration testing, forensic examination, incident response and threat hunting through to designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within the licensing duty even without performing any of the Schedule's other listed services.
A granted licence runs for two years and must be renewed at least one month before expiry, may not be transferred, and may not be used for a purpose other than the one for which it was granted. Providing a cybersecurity service without a licence carries an administrative penalty equal to the cost of the damage caused and the value of the financial gain made rather than a fixed sum, while transferring a granted licence is a separate criminal offence.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .