Cybersecurity law & regulation in Ghana (2026)
Cybersecurity in Ghana: comprehensive law.
Ghana enacted a standalone, comprehensive cybersecurity law, the Cybersecurity Act, 2020 (Act 1038), which established the Cyber Security Authority (CSA) as the primary regulator, mandated protection of Critical Information Infrastructure (CII) across 13 designated sectors, and imposed incident-reporting and licensing obligations. The Data Protection Act, 2012 (Act 843) runs in parallel, requiring breach notification to the Data Protection Commission. A Cybersecurity (Amendment) Bill, 2025 was published for public consultation in October 2025 and, as of May 2026, has not yet been enacted by Parliament.
Legal framework
Cybersecurity Act, 2020 (Act 1038), administered by the Cyber Security Authority (CSA)
Key points: cybersecurity in Ghana
Cybersecurity Act 1038 (2020)
Enacted 29 December 2020, the Act is Ghana's primary cybersecurity statute. It creates the Cyber Security Authority, regulates cybersecurity service providers and practitioners, and provides the legal basis for protecting Critical Information Infrastructure.
Critical Information Infrastructure (CII)
The Minister designated 13 sectors as CII by Gazette Notice No. 132 on 23 September 2021, followed by the launch of the CII Protection Directive on 1 October 2021. CII owners must register systems with the CSA, conduct periodic security audits, and report incidents.
Incident Reporting (24-hour duty)
Act 1038 requires owners of designated CII systems to report cybersecurity incidents to CERT-GH within 24 hours of detection. A dedicated online incident reporting portal is operated by the CSA.
Licensing & Accreditation
Cybersecurity service providers must obtain a licence from the CSA; individual practitioners must be accredited. Cybersecurity products and technology solutions also require CSA certification before deployment.
Data Protection Act 843 (2012), parallel breach-notification
The Data Protection Act, 2012 (Act 843) requires data controllers to notify the Data Protection Commission and affected individuals as soon as reasonably practicable following a personal-data security breach, complementing the CSA incident-reporting regime.
Cybersecurity Amendment Bill 2025 (pending)
A draft Cybersecurity (Amendment) Bill, 2025 was published by the CSA for public consultation (extended to 14 November 2025). It proposes expanded CSA investigative and enforcement powers, stricter penalties, and explicit parallel breach-notification to the Data Protection Commission. As of May 2026, it has not been passed by Parliament.
Timeline of decisions
- Decision · officialBank of Ghana launches Cyber and Information Security Directive 2026
The Bank of Ghana issued CISD 2026, replacing the 2018 framework and establishing mandatory cybersecurity standards — including data-localisation requirements, board-level accountability, AI governance, and incident-response protocols — for all licensed financial institutions and fintech firms operating in Ghana.
Bank of Ghana
- Law · officialCybersecurity (Amendment) Bill 2025 published for public consultation
The CSA released a draft amendment to Act 1038 that would grant the CSA Director-General and authorised officers powers to arrest, search, and seize, functions currently reserved for police, and impose stricter penalties for cyber offences. The bill is before Parliament's Communications Committee and has drawn fierce opposition from the parliamentary Minority over civil-liberties concerns.
Cyber Security Authority Ghana
- Guidance · officialNational Cybersecurity Policy and Strategy 2024 adopted
At the opening of the 2024 National Cybersecurity Awareness Month, the CSA launched an updated NCPS establishing a National Cybersecurity Risk Management Framework, operationalising the national CERT ecosystem (CERT-GH), and setting standards for CII protection, cybersecurity certification, and child online protection. This is the operative strategic framework driving all current sectoral obligations.
Cyber Security Authority Ghana
- Enforcement · officialCSA issues first batch of cybersecurity licences and accreditations
The Cyber Security Authority issued the first formal licences to 51 cybersecurity service providers, establishments, and professionals, activating the mandatory licensing regime under the Cybersecurity Act 2020 and warning that unlicensed operators face administrative penalties and criminal prosecution.
Cyber Security Authority
- Decision · officialCSA mandatory licensing regime for cybersecurity service providers enters enforcement phase
From January 2023 onward, no business or individual could legally offer cybersecurity services in Ghana without a CSA licence or accreditation under Section 52 of the Cybersecurity Act 2020, marking the first active enforcement phase of the Act's commercial licensing provisions.
Cyber Security Authority
- Decision · officialCybersecurity Service Providers Programme (CSPP) accreditation scheme launched
The CSA launched a mandatory licensing and accreditation regime for firms providing cybersecurity services in Ghana, covering penetration testing, vulnerability assessment, SOC operations, and incident response. Companies must obtain CSA accreditation to operate lawfully, creating a direct compliance obligation for the cybersecurity-services market.
Cyber Security Authority Ghana
- Decision · officialCyber Security Authority officially launched and CII Protection Directive issued
The Minister of Communications officially launched the CSA as Ghana's dedicated cybersecurity regulator under Act 1038, and simultaneously published the Directive for the Protection of Critical Information Infrastructure. The CII Directive requires designated infrastructure owners in energy, finance, and telecoms to undergo mandatory audits, report incidents within 24 hours, and disclose vulnerabilities within 72 hours.
Cyber Security Authority Ghana
- Law · officialCybersecurity Act, 2020 (Act 1038) enacted — landmark online safety law
Ghana's core cybersecurity statute established the Cyber Security Authority, created a licensing regime for cybersecurity practitioners, mandated registration and audit of critical information infrastructure, empowered authorities to order content takedowns threatening national security or children's safety, and introduced criminal penalties for cyber offences — forming the cornerstone of the current online safety framework.
GhaLII / Parliament of Ghana
- Law · officialCybersecurity Act 2020 (Act 1038) enacted
Ghana's principal cybersecurity statute, 100 sections across 17 parts, establishes the Cyber Security Authority, creates a licensing regime for cybersecurity service providers, designates Critical Information Infrastructure categories, mandates incident reporting for regulated entities, and prescribes administrative and criminal penalties. It replaced the prior policy-only regime with binding legal obligations for the first time.
Ghana Legal Information Institute (GhaLII)
- Decision · officialNational Cyber Security Centre (NCSC) established
The government upgraded the National Cyber Security Secretariat (created in 2017) into the National Cyber Security Centre with an expanded mandate to coordinate national incident response and oversee implementation of the NCSPS. This institutional step built the operational nucleus that would ultimately become the Cyber Security Authority under Act 1038.
Cyber Security Authority Ghana
- Guidance · officialUpdated National Cybersecurity Policy and Strategy launched; NCSS and first Cybersecurity Advisor appointed
President Akufo-Addo inaugurated the National Cybersecurity Inter-Ministerial Advisory Council during Ghana's inaugural National Cybersecurity Week and launched a revised NCSPS. The National Cyber Security Secretariat (NCSS) was simultaneously established and the first National Cybersecurity Advisor was appointed, marking Ghana's formal transition to a structured institutional framework for cybersecurity governance.
Cyber Security Authority Ghana
- Guidance · officialFirst National Cyber Security Policy and Strategy receives Cabinet approval
Ghana's Ministry of Communications, with World Bank support, secured Cabinet approval for the country's first formal National Cyber Security Policy and Strategy. The policy introduced five pillars, legal measures, technical measures, organisational measures, capacity building, and international cooperation, establishing the governance architecture on which all subsequent cybersecurity legislation has been built.
ITU (International Telecommunication Union)
- Law · officialNational Information Technology Agency Act 2008 (Act 771) enacted
Act 771 established NITA as the ICT-policy implementation arm of the Ministry of Communications, mandating it to develop and enforce IT standards and security guidelines for government agencies and e-government infrastructure. NITA's standards work provided the first mandatory cybersecurity baseline for the public sector and laid the regulatory-capacity foundation for the later Cybersecurity Act.
Ghana Legal Information Institute (GhaLII)
- Law · officialElectronic Transactions Act 2008 (Act 772) enacted, Ghana's first cybercrime statute
Act 772 was Ghana's first comprehensive cybercrime and electronic-evidence law, criminalising computer fraud, unauthorised access and interception, and electronic forgery with higher penalties than the general Criminal Code. It established procedural rules for seizing and authenticating electronic evidence and remains the primary criminal-law vehicle for cyber offences not specifically addressed by the Cybersecurity Act 2020.
Parliament of Ghana Repository
Sources
- ir.parliament.gh/bitstream/handle/123456789/1800/CYBERSECURITY%20ACT,%202020%20(ACT%20
- ghalii.org/akn/gh/act/2020/1038/eng@2020-12-29/source.pdf
- csa.gov.gh/
- csa.gov.gh/cii
- csa.gov.gh/resources/Directive_CII.pdf
- csa.gov.gh/report
- csa.gov.gh/resources/Cybersecurity%20(Amendment)%20Draft%20Bill%202025%20final%2
- nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdf
- dataprotection.org.gh/compliance/
- iipgh.org/navigating-the-ghana-cybersecurity-amendment-bill-2025-protecting-nat
Next for Ghana: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026