The government is proposing sweeping changes to Ghana’s Cybersecurity Act, 2020 (Act 1038) through a new draft Cybersecurity (Amendment) Bill, 2025. The amendments seek to expand the powers of the Cyber Security Authority (CSA), strengthen regulation of emerging technologies, and tighten protection for critical information infrastructure as Ghana’s digital economy continues to grow.
The draft bill, now before Parliament, introduces several new functions and enforcement mechanisms. It grants the CSA authority, in collaboration with the Attorney-General’s office, to investigate and prosecute cyber offences. It also gives the Authority policing powers such as arrest, search, and seizure, while requiring owners of critical information infrastructure—like telecoms networks, financial systems, and government databases—to register with the CSA and meet specific security standards.
Under the proposed law, all cybersecurity service providers and professionals will be required to obtain licences or accreditation before operating. The bill further empowers the CSA to issue security certifications for products and services that rely on emerging technologies such as artificial intelligence, blockchain, big data, and cloud computing. It also establishes new funding streams for the CSA, including a portion of communication service tax and corporate tax contributions, to sustain its regulatory activities.
Government officials argue that the proposed changes are necessary to respond to the growing sophistication of cyber threats and to protect citizens, institutions, and businesses in the digital age. They say the amendments are part of Ghana’s effort to maintain a robust cybersecurity posture, safeguard national data assets, and align with international best practices.
However, civil society organisations and media groups have expressed concern over parts of the draft. The Ghana Journalists Association and the Institute for Liberty and Policy Innovation have warned that certain provisions could undermine press freedom and digital rights. They point to the broad enforcement powers granted to the CSA—such as unrestricted access to data and the ability to arrest suspects—as potential risks to privacy and due process. Critics argue that the bill blurs the line between regulatory oversight and criminal enforcement and could be used to stifle online expression.
The Ministry of Communications, Digital Technology and Innovation, which is sponsoring the bill, has dismissed those fears, insisting that the law is not intended to silence critics or monitor journalists. Officials maintain that the amendments are designed purely to protect citizens and businesses from cybercrime, online fraud, and digital espionage, all of which have increased in frequency and complexity.
If passed, the bill will have far-reaching implications for businesses, especially those operating online or in technology sectors. Companies will be required to meet higher cybersecurity compliance standards and report cyber incidents to the CSA. Individuals and firms offering cybersecurity services will have to undergo accreditation, while owners of critical information systems could face penalties for failing to implement adequate protection measures.
Observers say the real challenge lies in striking a balance between enhancing national security and protecting constitutional freedoms. As digitalisation accelerates across banking, education, health, and government services, the need for strong cybersecurity regulation is undeniable—but so is the importance of transparency, accountability, and respect for rights.
Public consultations on the bill have already taken place, and Parliament’s Communications Committee is reviewing feedback from stakeholders. The final version is expected to incorporate recommendations from both industry and civil society before it is tabled for passage.
The Cybersecurity (Amendment) Bill, 2025, is therefore a test of Ghana’s ability to modernise its digital laws without compromising its democratic values. It reflects a growing recognition that cyber threats are no longer abstract risks but real dangers to national security, economic stability, and individual privacy. Whether Parliament can refine the bill to achieve that balance will determine how Ghana’s digital future unfolds.
