GhanaElectronic Transactions Act, Cyber Offences
Electronic Transactions Act, 2008 (Act 772), ss. 124, 130-134 (Cyber Offences)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Access restriction, Security
- Audit expectation
- none
What it requires
- Do not access or intercept an electronic record without authority or permission, whether or not the record sits behind a login.NIST AI RMFMAP 4.1
- Do not cause a computer to perform any function to secure access to a programme or electronic record without authority.NIST AI RMFMAP 4.1
- Do not access, or exceed authorised access to, a computer holding financial, government, or national-security information; this carries the Act's highest penalty tier.NIST AI RMFMAP 4.1
- Do not disclose a password or access code, or modify a programme or electronic record, without authority.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
The base unauthorised-access offences (ss. 124, 130) each carry a fine of not more than two thousand five hundred penalty units or imprisonment of not more than five years, or both. Unauthorised disclosure of an access code (s. 132) and the aggravated offence of accessing a protected computer (s. 133) each carry a fine of not more than ten thousand penalty units or imprisonment of not more than twenty years, or both, which is the Act's highest tier for any offence in this Part.
Penalty structure
Sections 132 (unauthorised disclosure of an access code) and 133 (accessing a protected computer without authorisation) each carry the highest fixed fine in this Part, ten thousand penalty units, alongside imprisonment of not more than twenty years. The base offences of unauthorised access or interception (s. 124) and unauthorised access to a computer programme or electronic record (s. 130) carry two thousand five hundred penalty units and imprisonment of not more than five years. One penalty unit equals twelve Ghana cedis under the Fines (Penalty Units) Act, 2000 (Act 572), as recorded by the Ghana Revenue Authority, making the ten-thousand-unit ceiling one hundred twenty thousand Ghana cedis.
- Rule
- Fixed only
- As of
- Currency
- GHS
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Ghana Police Service, prosecuted before the ordinary criminal courts
Settledness
- As of
- Open questions
- Does a person who retrieves a web page that its operator serves to every visitor "have consent to access the kind of programme or data" within the Act's definition of "unauthorised access", where the operator's terms of use forbid automated collection?
What it makes you log
Logging duty
Sections 124 and 130 to 134 punish unauthorised access to or interception of an electronic record, access to a programme, unauthorised modification, disclosure of an access code, and access touching national interest or security, with the penalties each states. None requires a log or record to be made, kept, produced or reviewed. Section 141, which makes the searcher list what was seized, is a duty on the investigating officer and is outside the offence sections this row cites. Section 142 states the territorial scope of offences under the Act: it applies where the accused was in the country at the material time, and also where the computer or record was located in the country; only the accused-presence limb maps to a hook value.
- Kind
- None
- As of
What this law does
Section 124 punishes a person who intentionally accesses or intercepts an electronic record without authority or permission. Section 130 punishes a person who knowingly and without authority causes a computer to perform any function to secure access to a programme or electronic record held in that computer or any other computer, and section 131 punishes an unauthorized modification of a programme or electronic record.
Section 133 creates an aggravated offence, whoever knowingly accesses a computer without authorisation or exceeds authorised access to a protected computer, one holding information from a financial institution, a government department, a national-security matter, or otherwise designated protected, and carries the Act's highest tier. Section 134 punishes intentionally causing a computer to cease to function, including by virus or worm.
None of these provisions exempts a publicly accessible, unauthenticated page from the definition of unauthorized access, which the Act defines as access a person is neither personally entitled to nor has been given consent to obtain.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .