Ghana Cybersecurity Act
Ghana's Cybersecurity Act, 2020 (Act 1038), which created the Cyber Security Authority and requires owners of designated critical information infrastructure to register, report incidents within 24 hours, commission and submit annual audits and meet the Authority's 2021 baseline Directive, requires every institution to report incidents within 24 hours, licenses cybersecurity service providers and accredits professionals, and places lawful-access, interception and data retention duties on service providers. Built from the Act's own sections and the CII Directive.
Ghana Cybersecurity Act is a compliance framework from Ghana with 7 domains and 44 controls that map to 93 other frameworks. The largest domains are Directive for the Protection of Critical Information Infrastructure (2021) – Ghana Cybersecurity Act (21 controls), Licensing, accreditation and standards (sections 49 to 61) – Ghana Cybersecurity Act (7 controls), Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Computer emergency response teams and incident reporting (sections 41 to 48) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::44 | Sections 44 and 47(1): operate a sectoral CERT that reports monthly, forwards incidents and follows the Authority's directives |
| ghana-cybersecurity-act::47.2 | Section 47(2): licensed cybersecurity service providers report on their operations and incidents |
| ghana-cybersecurity-act::47.5 | Sections 47(5) and 48(2): every institution reports a cybersecurity incident within 24 hours |
Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::36.1 | Section 36(1) and (2): register the designated critical information infrastructure with the Authority |
| ghana-cybersecurity-act::36.3 | Section 36(3): tell the Authority of a change in legal ownership within seven days |
| ghana-cybersecurity-act::39.1a | Section 39(1)(a): report a cybersecurity incident on critical information infrastructure within 24 hours |
| ghana-cybersecurity-act::39.1b | Section 39(1)(b) and Directive 5.2(k): cause a cybersecurity audit of the critical information infrastructure every year |
| ghana-cybersecurity-act::39.1c | Section 39(1)(c) and Directive 7(b): submit the audit report and the other required reports to the Authority |
Directive for the Protection of Critical Information Infrastructure (2021) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::CIID.5.1 | Directive 5.1: board-approved cybersecurity policy for the designated CII, reviewed yearly |
| ghana-cybersecurity-act::CIID.5.1c | Directive 5.1(c): appoint a senior accountable officer for cybersecurity governance |
| ghana-cybersecurity-act::CIID.5.2a | Directive 5.2(a): identify, classify and catalogue all CII assets |
| ghana-cybersecurity-act::CIID.5.2b | Directive 5.2(b): control and manage access to CII systems and services |
| ghana-cybersecurity-act::CIID.5.2c | Directive 5.2(c): mitigate cyber risk from employees, customers, suppliers and other third parties |
| ghana-cybersecurity-act::CIID.5.2d | Directive 5.2(d): security screening of personnel who handle CII information |
| ghana-cybersecurity-act::CIID.5.2e | Directive 5.2(e): cybersecurity awareness and training for all employees |
| ghana-cybersecurity-act::CIID.5.2f | Directive 5.2(f): security monitoring and response for timely detection |
| ghana-cybersecurity-act::CIID.5.2g | Directive 5.2(g): physical protection of CII systems and dependent assets |
| ghana-cybersecurity-act::CIID.5.2h | Directive 5.2(h): maintenance and software updates against equipment failure |
| ghana-cybersecurity-act::CIID.5.2i | Directive 5.2(i): business continuity and disaster recovery plans, tested and updated |
| ghana-cybersecurity-act::CIID.5.2j | Directive 5.2(j): quarterly cybersecurity risk assessment |
| ghana-cybersecurity-act::CIID.5.2l | Directive 5.2(l): keep a cybersecurity risk register for the CII |
| ghana-cybersecurity-act::CIID.5.2m | Directive 5.2(m): take part in cybersecurity exercises with the Authority and other sectors |
| ghana-cybersecurity-act::CIID.5.2o | Directive 5.2(o): keep source code of critical systems in escrow |
| ghana-cybersecurity-act::CIID.5.3a | Directive 5.3(a): investigate and mitigate incidents to the Authority's standards |
| ghana-cybersecurity-act::CIID.5.3c | Directive 5.3(c): a point of contact for incident reporting and advisories |
| ghana-cybersecurity-act::CIID.5.3d | Directive 5.3(d): disclose vulnerabilities found in audits and assessments within 72 hours |
| ghana-cybersecurity-act::CIID.7d | Directive 7(d): notify the Authority of planned significant changes before board approval |
| ghana-cybersecurity-act::CIID.7e | Directive 7(e): seek the Authority's clearance one month before a major organisational change |
| ghana-cybersecurity-act::CIID.8 | Directive 8: request clearance before any activity that could affect a CII |
Industry Forum and miscellaneous provisions (sections 81 to 100 and Schedules) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::86 | Sections 86 and 88: provide information the Authority requests and cooperate with it |
| ghana-cybersecurity-act::87 | Section 87: comply with a court-ordered authorisation to block, filter or take down |
| ghana-cybersecurity-act::92 | Section 92: comply with the Authority's directives |
Investigatory powers, interception and data retention (sections 69 to 80) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::70 | Sections 70(2), 72(2) and 74(2) to (4): execute production orders and interception warrants and keep them confidential |
| ghana-cybersecurity-act::76 | Section 76: install an interception capability when the Authority requests, with a cleared focal person |
| ghana-cybersecurity-act::77.1 | Section 77(1) to (3): retain subscriber information six years and traffic and content data twelve months |
| ghana-cybersecurity-act::77.4 | Section 77(4): use retained or retrieved data only for the warrant's purpose |
Licensing, accreditation and standards (sections 49 to 61) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::49 | Sections 49, 50 and 100(2): hold a licence before providing any cybersecurity service |
| ghana-cybersecurity-act::49.buy | Section 92 in practice: engage only licensed cybersecurity service providers of the right tier |
| ghana-cybersecurity-act::51 | Section 51(3) and (5): keep to the licence's terms, conditions and purpose |
| ghana-cybersecurity-act::52 | Section 52: never transfer a licence |
| ghana-cybersecurity-act::53 | Section 53: renew the two-year licence at least one month before expiry |
| ghana-cybersecurity-act::57 | Section 57 and the CSA Guidelines: accreditation of cybersecurity professionals and establishments |
| ghana-cybersecurity-act::59 | Section 59(2) to (4) and Directive 5.2(n): comply with the cybersecurity standards the Authority adopts |
Online offences against children and others (sections 62 to 68) – Ghana Cybersecurity Act
| Code | Title |
|---|---|
| ghana-cybersecurity-act::64 | Section 64: online service operators must not facilitate or permit child sexual solicitation on their service |
Your Compliance Coverage
If you comply with Ghana Cybersecurity Act, you already cover:
Privacy Act 1988 (Australia)
11%
6 controls mapped
Compare →OWASP Top 10:2025
11%
6 controls mapped
Compare →Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP)
11%
6 controls mapped
Compare →+ 90 more: Law No. 172-13 on the Protection of Personal Data (11%), India DPDP Act (11%)
See all 93 mapped frameworks ↓Maps to 93 other frameworks
Coverage is not the same as your position
This page shows what Ghana Cybersecurity Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Ghana Cybersecurity Act and who does it apply to?
Ghana Cybersecurity Act is a compliance framework from Ghana with 7 domains and 44 controls. Ghana's Cybersecurity Act, 2020 (Act 1038), which created the Cyber Security Authority and requires owners of designated critical information infrastructure to register, report incidents within 24 hours, commission and submit annual audits and meet the Authority's 2021 baseline Directive, requires every institution to report incidents within 24 hours, licenses cybersecurity service providers and accredits professionals, and places lawful-access, interception and data retention duties on service providers. Built from the Act's own sections and the CII Directive. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Ghana Cybersecurity Act actually require?
Ghana Cybersecurity Act has 44 controls organised across 7 domains. The largest domains are Directive for the Protection of Critical Information Infrastructure (2021) – Ghana Cybersecurity Act (21 controls), Licensing, accreditation and standards (sections 49 to 61) – Ghana Cybersecurity Act (7 controls), Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Ghana Cybersecurity Act do I already cover?
Ghana Cybersecurity Act maps to 93 other compliance frameworks. The top mapping partners are Privacy Act 1988 (Australia) (11% coverage), OWASP Top 10:2025 (11% coverage), Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) (11% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Ghana Cybersecurity Act?
Start your Ghana Cybersecurity Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Ghana Cybersecurity Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 44 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required