The Cyber-Security Amendment Bill 2025
The cybersecurity question
Ghana's proposed Cyber-Security Amendment Bill 2025 asks a deceptively simple question: how much power can a single regulatory body lawfully hold over digital assets, automated systems and citizen data without breaching constitutional commitments? On 16 September 2026, Dr. Thomas Anabah, a senior parliamentary figure, stated publicly that Parliament would only pass the Bill after consensus-building, acknowledging the depth of division over its scope. That delay is itself informative: it signals that the legislative branch recognises the Bill's constitutional stakes.
What the Bill changes
The existing Cybersecurity Act, 2020 (Act 1038) established the Cyber-Security Authority (CSA) with investigative and enforcement powers over cyber-security activities in Ghana. The Amendment Bill goes further. It would extend the CSA's mandate to include prosecuting cyber-offences directly, seizing digital assets, regulating automated decision-making systems and imposing penalties for the misuse of deep-fake content. A new provision creates a "Digital Rights Council" to monitor CSA actions. The 2012 Data Protection Act (Act 843), which currently governs personal data processing through the Data Protection Commission (DPC), would sit alongside these expanded powers without a clearly articulated hierarchy of oversight.
The constitutional tension
Article 12 of the 1992 Constitution guarantees the right to privacy and prohibits arbitrary interference. Article 19 protects freedom of expression, subject to reasonable restriction. The Bill's seizure powers, as drafted, lack a mandatory independent judicial review mechanism. Digital assets are property; their seizure without prompt judicial authorisation risks constituting an arbitrary interference with both property rights and privacy. The penalties for misuse of automated decision-making are described in terms that could be read in more than one way, creating a vagueness problem that threatens Article 19's protection against chilling effects on legitimate speech and innovation.
The strongest case for the Bill
Supporters make a credible argument. Cyber-crime in Ghana, as across the region, is evolving faster than the 2020 Act envisioned. Fraud, identity theft and AI-generated misinformation now pose harms that the 2012 data protection framework was not designed to address. The urgency is real: waiting for perfect legislative language can leave citizens and businesses exposed. The Digital Rights Council, though new, provides a structural check that did not exist under Act 1038. From this vantage, the Bill is a necessary modernisation, not an overreach.
Where consensus-seeking must be rigorous
The government's stated commitment to consensus-building is welcome, but the form of that process matters. A public hearing in which the CSA presents its operational rationale alongside submissions from civil-society digital rights organisations, the DPC and affected industry stakeholders would raise the quality of the input Parliament receives. Without it, "consensus" risks becoming a label applied to a pre-determined outcome.
A realistic path forward
Three targeted amendments would preserve the Bill's security objectives while resolving the most serious constitutional concerns. First, require any seizure of digital assets to be approved by an independent magistrate within 48 hours, with a right of appeal. Second, codify precise definitions of "automated decision-making" and "deep-fake content" so that penalties attach to identifiable conduct rather than open-ended categories. Third, mandate that all CSA investigations involving personal data comply with the Data Protection Act, including data-subject rights and audit trails. These are not radical proposals; they are the minimum threshold for a rights-based digital security regime.
The Bill's delay is not a failure.
Safeguards that should accompany stronger powers
The policy choice is not simply between strong cyber-security enforcement and individual rights. The difficult work lies in defining the grounds for a search or seizure, requiring independent review where appropriate, limiting the use and retention of collected information, and giving affected persons a practical route to challenge mistakes. Each safeguard should be evaluated against the exact text ultimately enacted. A proposal can change before it becomes law, so the bill's reported provisions should not be treated as powers already in force.
Parliament can strengthen enforcement while making the scope of discretion transparent. Requiring written reasons, independent oversight and regular public reporting would give both investigators and the public clearer rules. The measure of success will be whether the final legislation addresses real cyber threats while remaining open to constitutional scrutiny, including scrutiny of how the powers are used in practice.