Act 1038 Explained: What Ghana's Cybersecurity Act Means for Your Organisation

The Cybersecurity Act, 2020 (Act 1038) is the main law regulating cybersecurity in Ghana. It created the Cyber Security Authority, set up licensing for cybersecurity service providers, provides for the accreditation of cybersecurity establishments and professionals, and places duties on owners of critical information infrastructure. This guide explains what that means for your organisation in plain English, with a link to the official source for each point.

What Is the Cyber Security Authority?

Act 1038 establishes the Cyber Security Authority (CSA) to regulate cybersecurity activities in Ghana and to promote the development of cybersecurity in the country. The text of the Act sets out its objects and functions; a public copy is also available on GhaLII. In practice, the CSA is the body that licenses providers, accredits establishments and professionals, works with owners of critical information infrastructure and coordinates national incident response.

Who Needs a Licence Under Act 1038?

Under section 49 of Act 1038, a person must not provide a cybersecurity service for reward without a licence from the Authority. The CSA's licensing and accreditation page explains the regime and how to apply. Licences are issued by service category. The licence categories are: managed cybersecurity services; vulnerability assessment and penetration testing (VAPT); digital forensics services; cybersecurity governance, risk and compliance; and cybersecurity training.

The CSA's licensing and accreditation FAQ states that licences and accreditation certificates are valid for two years and explains renewal.

What Does Accreditation of Establishments and Professionals Mean?

Licensing applies to service providers. Accreditation is the formal recognition of cybersecurity establishments and of cybersecurity professionals. Act 1038 provides for a mechanism to accredit cybersecurity professionals, and the CSA runs accreditation alongside licensing; the CSA licensing and accreditation page and FAQ describe who applies and how.

What Is Critical Information Infrastructure?

The Act allows computer systems or networks to be designated as critical information infrastructure (CII) where they are essential to national security or to the economic and social well-being of citizens, such as systems supporting public utilities, banking and financial services, telecommunications and government operations. Designated CII must be registered with the Authority, and its owners must meet the duties the Act and the CSA's directive for the protection of CII set out, including audits and compliance with prescribed standards.

What Are the Incident Reporting Duties?

Act 1038 sets incident-reporting duties, including a requirement for owners of CII to report a cybersecurity incident within 24 hours of detection to the relevant sectoral computer emergency response team or the National CERT. The Act text sets out who must report, to whom and when. Every organisation should know, before an incident, who decides whether a report is required and who sends it.

How Do You Check a Provider's Licence?

Before you engage a cybersecurity provider in Ghana, check that it holds a current CSA licence for the service you are buying. The CSA publishes information on licensed providers and accredited establishments and professionals, and offers certificate verification. Ask the provider for its licence category and certificate details, and confirm them with the CSA directly.

Check the category as well as the licence itself. A provider licensed for one category, such as training, is not automatically licensed for another, such as penetration testing or digital forensics. Check the expiry date too, because licences must be renewed. Keep a record of the check with your supplier due-diligence file, so you can show later how the provider was chosen.

What Questions Should You Ask a Cybersecurity Provider?

• Which CSA licence category covers the service you are offering us, and when does the licence expire?
• Will any part of the work be subcontracted, and is the subcontractor also licensed for that service?
• Are the professionals who will do the work accredited where the CSA requires it?
• How will you support us if an incident has to be reported under the Act?

Clear answers to these questions, checked against the CSA's own records, protect you from engaging an unlicensed provider for regulated work.

How Should You Prepare to Report an Incident?

A reporting duty is only as good as the process behind it. Decide in advance who confirms that an incident has occurred, who decides whether it must be reported, and who sends the report. Keep current contact details for the relevant sectoral CERT and the National CERT. Prepare a short template covering what happened, when it was detected, which systems and services are affected and what has been done so far. Then rehearse it in a tabletop exercise, so the clock does not start for the first time during a real incident.

What Does Act 1038 Mean for Different Roles?

If you buy cybersecurity services, your main duty is diligence: engage licensed providers for the services the Act regulates, and keep records of the checks you made.

If you provide cybersecurity services for reward, you need a licence for each relevant category, and you should check the accreditation requirements that apply to your establishment and staff in the CSA FAQ.

If you own or operate designated CII, your duties go further: registration, compliance with the CSA's directive, audits and incident reporting. These belong in your governance framework with named owners.

Are There Proposed Changes to Act 1038?

Yes. The CSA has published a draft Cybersecurity (Amendment) Bill, 2025 for consultation. It is proposed, not in force. A bill changes nothing until Parliament passes it and it takes effect. This guide describes Act 1038 as currently enacted.

What Should Each Organisation Do Now?

Banks and other regulated firms

• Check whether any of your systems have been designated as CII, and confirm your registration and reporting arrangements.
• Confirm that every cybersecurity provider you use holds a current CSA licence for the service it delivers.
• Build the 24-hour reporting window into incident response plans and test it in exercises.

Government and critical-infrastructure organisations

• Confirm the CII status of your systems with the CSA and keep the registration details current.
• Map the duties in the Act and the CII directive to controls, owners and evidence.
• Agree in advance who reports incidents to the sectoral CERT or National CERT, and how.

Growing mid-sized businesses

• Check that any provider selling you cybersecurity services is licensed by the CSA.
• Name one person responsible for cybersecurity incidents and decisions about reporting.
• Keep an eye on the proposed amendment bill, but plan against the Act as it stands.

Where Should You Start?

Most organisations can begin with three steps. First, list the cybersecurity services you buy and confirm each provider's CSA licence. Second, check with the CSA whether any of your systems are designated as CII, and if so confirm registration and the duties that follow. Third, write down how you would report an incident, who is involved and which CERT you would contact, then test it. Keep the evidence of each step: it is what a board, auditor or regulator will ask to see, and it makes later reviews much faster.

How Does Act 1038 Relate to Other Requirements?

Act 1038 sits alongside the Data Protection Act, 2012 (Act 843) and sector rules. Many organisations manage them together through one control framework; see Governance, Risk & Compliance and Regulatory Assurance. Where you also want a recognised certificate, our ISO 27001 certification in Ghana readiness guide explains the path.

This article is general information, not legal advice. Check the official sources or speak to a qualified lawyer for your situation.