Ghana Cybersecurity Act

Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act

Ghana Cybersecurity Act 36.3: Section 36(3): tell the Authority of a change in legal ownership within seven days

What does 36.3 require?

Where the legal ownership of a registered critical information infrastructure changes, its owner must inform the Authority within seven days after the change. Failure carries the Second Schedule administrative penalty of 500 to 10,000 penalty units (a penalty unit is GHS 12, the value the Authority's August 2026 sanctions applied).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act

36.1 Section 36(1) and (2): register the designated critical information infrastructure with the Authority
39.1a Section 39(1)(a): report a cybersecurity incident on critical information infrastructure within 24 hours
39.1b Section 39(1)(b) and Directive 5.2(k): cause a cybersecurity audit of the critical information infrastructure every year
39.1c Section 39(1)(c) and Directive 7(b): submit the audit report and the other required reports to the Authority

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Ghana Cybersecurity Act controls