Online safety & content laws in Ghana (2026)

The Bank of Ghana issued CISD 2026, replacing the 2018 framework and establishing mandatory cybersecurity standards — including data-localisation requirements, board-level accountability, AI governance, and incident-response protocols — for all licensed financial institutions and fintech firms operating in Ghana.

The Cyber Security Authority released the draft Cybersecurity (Amendment) Bill 2025, proposing expanded arrest, search, and seizure powers for the CSA Director-General, mandatory platform takedown obligations, and a self-funding mechanism retaining 50% of fines; civil society and parliament's Minority raised concerns about threats to free expression and due-process rights.

Ghana's Minister for Communications announced the MDHI Bill would be laid before Parliament, requiring media houses, digital platforms, and content creators to establish fact-checking processes and obtain annual certification; courts would be empowered to order ISPs to block access to sites disseminating harmful content.

The Cyber Security Authority launched the National Child Online Protection (COP) Framework — aligned with ITU guidelines and the WeProtect Global Alliance Model — to combat cyberbullying, online exploitation, and illegal collection of children's data, and to strengthen governance, victim support, and industry accountability.

The Cyber Security Authority issued the first formal licences to 51 cybersecurity service providers, establishments, and professionals, activating the mandatory licensing regime under the Cybersecurity Act 2020 and warning that unlicensed operators face administrative penalties and criminal prosecution.

From January 2023 onward, no business or individual could legally offer cybersecurity services in Ghana without a CSA licence or accreditation under Section 52 of the Cybersecurity Act 2020, marking the first active enforcement phase of the Act's commercial licensing provisions.

Ghana's core cybersecurity statute established the Cyber Security Authority, created a licensing regime for cybersecurity practitioners, mandated registration and audit of critical information infrastructure, empowered authorities to order content takedowns threatening national security or children's safety, and introduced criminal penalties for cyber offences — forming the cornerstone of the current online safety framework.

Ghana's Cabinet approved the National Cyber Security Policy & Strategy, the country's first government-wide roadmap addressing cyber threats, critical infrastructure protection, legal reform, and capacity-building, and designating the National Cyber Security Centre as the coordinating authority.

Ghana's first dedicated data-privacy law established the Data Protection Commission, required all data controllers to register and observe data-protection principles, prohibited direct marketing without prior written consent, and provided both civil and criminal sanctions — extending online privacy rights to all data subjects in Ghana.

Replacing the 1996 NCA law, Act 775 provided a unified statutory basis for the National Communications Authority to regulate electronic communications, broadcasting, and spectrum — including internet services — and gave GIFEC its mandate to extend connectivity to underserved communities.

Ghana's first comprehensive cybercrime legislation criminalised unauthorised access, data interception, denial-of-service attacks, and modification of computer systems, and gave law enforcement court-warrant-based powers to seize electronic evidence — laying the procedural foundation for all subsequent cybercrime prosecution in Ghana.