Cybersecurity Act, Licensing of Cybersecurity Service Providers

Cybersecurity Act, 2020 (Act 1038), ss. 49-53, First Schedule, and Second Schedule items 49(2) and 51(5)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 29 December 2020.

A sector security regimes rule binding public and private bodies.

As of 18 September 2026.

What it requires

This binds a person who provides a cybersecurity service for reward in Ghana, a term the First Schedule defines to include designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within it even without performing penetration testing, forensic examination, monitoring or any of the Schedule's other listed services; a general-purpose software product with no security-specific function is not reached by this term on its own.
Obtain a licence from the Cyber Security Authority before providing the cybersecurity service; the Authority acknowledges an application within fourteen days and decides it within thirty days.
A granted licence is valid for two years from the date it is granted; apply in writing for renewal not later than one month before it expires.
Do not transfer the licence to another person and do not use it for a purpose other than the one for which it was granted.
Providing a cybersecurity service without a licence is an administrative penalty equal to the cost of the damage caused and the value of the financial gain made, not a fixed sum; transferring a granted licence is a separate criminal offence carrying a fine of not less than five thousand penalty units and not more than ten thousand penalty units or imprisonment of not less than six months and not more than two years, or both.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Providing a cybersecurity service without a licence (s. 49(2)) is enforced only as an administrative penalty equal to the cost of the damage caused and the value of the financial gain made. Transferring a granted licence to another person (s. 52(2)) is a separate criminal offence, a fine of not less than five thousand penalty units and not more than ten thousand penalty units or imprisonment of not less than six months and not more than two years, or both.

Who enforces it

Enforcement body

The Cyber Security Authority, with a right of review to the Minister and then to a court of competent jurisdiction over a decision on a licence.

Settledness

As of: 18 September 2026
Open questions: Because a cybersecurity solution is not itself defined in the Act's interpretation section, does a vendor selling a general-purpose software product with some security feature fall inside the licensing duty, or only a vendor whose product is marketed specifically as a security tool?

What it reaches

Obligation class

Licensing

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A person may not provide a cybersecurity service in Ghana without a licence issued by the Cyber Security Authority. The First Schedule defines a cybersecurity service as one provided for reward and aimed at ensuring or safeguarding the cybersecurity of a computer or computer system.

Its list runs from penetration testing, forensic examination, incident response and threat hunting through to designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within the licensing duty even without performing any of the Schedule's other listed services.

A granted licence runs for two years and must be renewed at least one month before expiry, may not be transferred, and may not be used for a purpose other than the one for which it was granted. Providing a cybersecurity service without a licence carries an administrative penalty equal to the cost of the damage caused and the value of the financial gain made rather than a fixed sum, while transferring a granted licence is a separate criminal offence.

When LexLint raises it

distributes_software_product

Read the law

Cybersecurity Act, 2020 (Act 1038), full text (Centre for Democracy and Development, csdsafrica.org)

Back to the example · Lint your app