GhanaCybersecurity Act, Cybersecurity Standards and Enforcement
Cybersecurity Act, 2020 (Act 1038), s. 59, and Second Schedule item 59(4)
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds the public and private sectors generally in Ghana; the Act states no size or sector gate for this duty.
- Comply with the cybersecurity standards the Cyber Security Authority develops, establishes, adopts and publishes on its website, which by section 59(1) cover education and skills development, hardware and software engineering, governance and risk management, research and development, and any other area the Authority determines in line with international best practice.
- Breaching an adopted standard is an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units, payable to the Cyber Security Authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
A person who breaches a cybersecurity standard the Authority adopts under section 59 is liable only to an administrative penalty under section 59(4) and the Second Schedule; no provision reviewed here makes that breach, standing alone, a criminal offence.
Who enforces it
Enforcement body
The Cyber Security Authority, established under section 2 of the Cybersecurity Act, 2020 (Act 1038).
Settledness
- As of
- Open questions
- Has the Cyber Security Authority published the hardware and software engineering standards section 59(1)(b) directs it to develop, and if so what do they require of a software developer operating in Ghana?
What this law does
The Cyber Security Authority must develop, establish and adopt standards for cybersecurity covering education and skills development, hardware and software engineering, governance and risk management, research and development, and any other area it determines in line with international best practice. It must publish them on its website, and take the necessary measures to enforce them and monitor compliance by the public and private sectors.
A person who breaches an adopted standard is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units, payable to the Authority.
The Act names no size or sector gate for this duty and states no criminal penalty for a breach; the specific technical content of a standard the Authority adopts under this section, including whatever it requires of hardware and software engineering, is set outside the Act's own text and is not described here.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .