Ghana Electronic Transactions Act, 2008 (Act 772): A Complete Guide to Electronic Transactions, E-Commerce and Cybercrime Law

A comprehensive guide to Ghana’s Electronic Transactions Act, 2008 (Act 772), covering electronic records, digital signatures, e-commerce, consumer protection, cybercrime, domain names, electronic evidence and online business compliance.

Ghana’s Electronic Transactions Act, 2008 (Act 772) is a foundational piece of legislation governing electronic communications, electronic records, digital signatures, online transactions, e-government services, electronic commerce, domain names, cybersecurity and a broad range of cyber offences.

The Act was assented to on 18 December 2008 and was enacted to provide a legal framework for electronic communications and related transactions in Ghana. Its importance extends far beyond simply recognising electronic documents. It establishes rules for how electronic records can be created, signed, retained and used as evidence, while also creating consumer protections, regulatory mechanisms for authentication services, rules for service providers and intermediaries, and criminal offences involving computers and electronic systems.

For businesses operating online, government institutions, technology companies, e-commerce platforms, financial service providers, domain-name operators and ordinary consumers, understanding Act 772 is important because electronic activity can create legal rights and obligations just as traditional paper-based activity can.

This article examines the major provisions of the Electronic Transactions Act, 2008 (Act 772) and explains what they mean in practical terms.

Important: This article is an educational overview based on the supplied text of Ghana’s Electronic Transactions Act, 2008 (Act 772). It is not a substitute for advice from a qualified Ghanaian lawyer, particularly where a transaction, dispute, prosecution or regulatory decision is involved.

What Is the Electronic Transactions Act, 2008?

The Electronic Transactions Act, 2008, Act 772 is legislation of the Parliament of the Republic of Ghana designed to facilitate and regulate electronic communications and transactions.

At its core, the Act attempts to solve an important legal problem: traditional laws were often written around concepts such as writing, signatures, original documents, physical delivery and paper records.

Electronic commerce does not always operate in this way.

A modern transaction may involve:

• An online order;
• An electronic invoice;
• An email;
• A digital signature;
• An electronic payment;
• An automated computer system;
• An electronic contract;
• A digitally stored business record;
• A website;
• A domain name;
• An electronic government filing; or
• Data stored on a remote computer system.

Act 772 establishes circumstances in which these electronic processes can receive legal recognition.

It also establishes restrictions and offences intended to protect electronic systems from abuse.

Objectives of the Electronic Transactions Act

Section 1 establishes the principal objectives of the Act.

The legislation seeks to:

1. Remove and prevent barriers to electronic communications and transactions.
2. Promote legal certainty and confidence in electronic transactions.
3. Encourage e-government services.
4. Create a safe and secure environment for consumers, businesses and government.
5. Promote electronic transaction services that respond to consumer needs.
6. Take into account the needs of vulnerable groups and persons with disabilities.
7. Encourage compliance with accepted international technical standards.
8. Ensure efficient management of Ghana’s country domain-name space.
9. Protect the interests and image of Ghana in relation to electronic communications.

These objectives demonstrate that Act 772 is intended to do more than regulate online businesses.

It provides a broader legal infrastructure for Ghana’s digital economy.

Application and Scope of the Act

Section 2 provides that the Act applies to electronic transactions and electronic records of every type, subject to the limitations and exclusions established by the legislation.

However, the Act does not mean that every transaction must be electronic.

Section 3 makes this particularly important.

The Act does not generally require a person to:

• Create information electronically;
• Send information electronically;
• Receive information electronically;
• Store information electronically;
• Process information electronically; or
• Use an electronic signature.

In other words, the legislation facilitates electronic transactions without necessarily forcing every person or organisation to abandon traditional methods.

The Act also recognises that other laws may impose specific requirements regarding how certain documents or transactions must be handled.

Transactions Excluded From the Act

One of the most important aspects of Act 772 is understanding what it does not cover.

Section 4 excludes several categories of documents and transactions.

These include:

• Negotiable instruments covered by the Bills of Exchange Act;
• Powers of attorney;
• Trusts;
• Wills;
• Contracts for the sale or conveyance of immovable property or interests in immovable property;
• Bills of lading;
• Documents required for registration of companies, partnerships or sole proprietorships;
• Affidavits and statutory declarations sworn before a Commissioner for Oaths or Notary Public; and
• Other classes of documents or transactions that may be excluded by Gazette notification.

This is an important practical distinction.

The existence of legislation recognising electronic records does not automatically mean that every legal document can be completed electronically.

A business or individual should therefore determine whether the particular transaction falls within one of the statutory exclusions before relying entirely on electronic processes.

Legal Recognition of Electronic Records

Electronic Messages Can Satisfy Writing Requirements

Section 5 provides that where legislation requires information to be in writing, typed or printed form, the requirement may be satisfied by information that is:

• Available electronically;
• Accessible; and
• Capable of being retained for subsequent reference.

This is one of the fundamental principles of electronic transaction legislation.

An electronic record can therefore satisfy a legal requirement for writing when the statutory conditions are met.

For businesses, this can be particularly relevant to:

• Online agreements;
• Electronic correspondence;
• Digital invoices;
• Electronic notices;
• Online applications;
• Electronic confirmations; and
• Other business records.

Electronic Records as Originals

Section 6 addresses situations where the law requires information to be presented or retained in its original form.

An electronic record can satisfy that requirement where there is reliable assurance of its integrity and the record can be displayed to the person to whom it is presented.

The integrity assessment considers whether the information has remained:

• Complete; and
• Unaltered.

This highlights an important principle: keeping an electronic file is not necessarily enough.

Businesses should consider whether their systems can demonstrate that important records have not been improperly changed.

Admissibility of Electronic Evidence

Section 7 provides that an electronic record should not be denied admissibility as evidence merely because it is electronic, subject to the Act.

When determining the evidential weight of an electronic record, a court may consider:

• How the record was generated;
• How it was displayed;
• How it was stored;
• How it was communicated;
• How its integrity was maintained;
• How the originator was identified; and
• Other relevant circumstances.

This means electronic evidence can be legally significant.

For example, a company involved in a dispute might need to rely on:

• Emails;
• Electronic invoices;
• Transaction histories;
• Server records;
• Digital signatures;
• Online communications;
• System-generated records; or
• Other electronic documentation.

The reliability and integrity of those records can therefore become extremely important.

Retention of Electronic Records

Section 8 deals with electronic record retention.

Where a law requires a document, record or information to be retained, the requirement may be met electronically if the record:

1. Remains accessible;
2. Can be retained for later reference;
3. Is maintained in the original format or a format that accurately represents the original information; and
4. Allows the origin, destination, date and time of transmission or receipt to be identified.

The Act specifies a minimum electronic retention period of six years for such records.

This has practical implications for businesses.

A company that relies on electronic records should have a proper document-retention policy rather than simply storing files wherever convenient.

Important considerations include:

• Regular backups;
• Access controls;
• Audit trails;
• File integrity;
• Reliable storage;
• Recovery procedures; and
• Clear retention schedules.

Secure Electronic Records

Section 9 recognises the concept of a secure electronic record.

Where a security procedure has been applied to an electronic record at a particular point in time, the record is treated as a secure electronic record during the applicable period.

An unauthorised alteration to the security procedure can invalidate the record.

This reinforces the importance of protecting electronic records from unauthorised changes.

Digital Signatures Under Act 772

Digital signatures are another major component of the legislation.

When Can a Digital Signature Satisfy a Signature Requirement?

Section 10 provides that where a law requires a person’s signature, the requirement can be satisfied in relation to an electronic record through the use of a digital signature.

The Act considers a digital signature authentic where:

• The means of creating the signature is linked to the signatory;
• The means of creating it was under the signatory’s control when signing; and
• Any subsequent alteration to the digital signature can be detected.

This creates an important legal foundation for electronic signing.

Signing Electronic Records

Section 12 further provides that a person may sign an electronic record using:

• A personal digital signature; or
• Another recognised, secure and verifiable signing method agreed by the parties or recognised by the industry.

Businesses should therefore consider not only whether their electronic signing solution is technically convenient but also whether it provides adequate evidence of:

• Identity;
• Control;
• Consent;
• Integrity; and
• The relationship between the signature and the signed document.

Responsibility When Relying on a Digital Signature

Section 13 places responsibility on a person who relies on a digital signature.

That person must take reasonable steps to:

• Verify the authenticity of the signature; and
• Where a certificate supports the signature, verify the validity of that certificate and observe applicable limitations.

This is an important risk-management principle.

A digital signature should not necessarily be treated as automatically trustworthy simply because it appears on an electronic document.

Electronic Contracts and Automated Transactions

Electronic Contracts Can Be Valid

Section 23 provides that an agreement remains valid even where it was concluded partly or entirely through an electronic medium.

This is particularly relevant to:

• E-commerce;
• Online subscriptions;
• Digital service agreements;
• Online purchases;
• Electronic business-to-business contracts;
• Online applications; and
• Automated commercial systems.

The fact that parties did not sign a traditional paper contract does not automatically mean that no contract exists.

Automated Transactions

Section 17 also recognises automated transactions.

An electronic agent may participate in the formation of an agreement, and the transaction can remain valid.

An electronic agent can essentially be a computer program or automated system that performs actions without a person manually reviewing every step.

Examples could include systems that:

• Automatically process orders;
• Generate confirmations;
• Accept reservations;
• Process transactions; or
• Respond to electronic requests.

However, the Act provides protections where an individual makes a material error while interacting with an electronic agent, subject to specified conditions.

This is especially relevant to businesses designing automated online platforms.

Sending and Receiving Electronic Records

Act 772 establishes rules for determining when electronic records are sent and received.

Despatch

Section 18 generally considers an electronic record dispatched when it enters an information-processing system outside the control of the originator or the originator’s agent, unless the parties have agreed otherwise.

Receipt

Section 19 provides different rules depending on whether the recipient has designated an information system for receiving electronic records.

These rules can become significant in disputes about:

• Notices;
• Offers;
• Acceptances;
• Contract deadlines;
• Payment demands;
• Business communications; and
• Electronic correspondence.

Businesses should therefore carefully identify official email addresses and electronic communication channels.

Attribution of Electronic Records

Section 21 addresses when an electronic record can be treated as originating from a particular person.

An electronic record may be attributed to the originator where it was sent:

• Personally by the originator;
• By someone authorised to act for the originator; or
• By an information system programmed by or on behalf of the originator.

The provision also establishes circumstances in which an addressee may rely on an electronic record as originating from the apparent sender.

This is important because businesses increasingly use automated systems to communicate with customers.

Electronic Acknowledgement of Receipt

Section 22 allows acknowledgement of receipt to occur through:

• An automated communication;
• Another communication from the recipient; or
• Conduct indicating that the electronic record was received.

An acknowledgement is generally not necessary to give a message legal effect unless the parties have agreed otherwise.

For important transactions, however, businesses may still benefit from maintaining reliable evidence of receipt.

Electronic Government Services

Act 772 also addresses digital government.

Government Agencies and Electronic Filing

Section 25 requires public bodies to take steps or enter into arrangements to ensure that their functions can be carried out, delivered or accessed electronically or online.

Section 26 permits public agencies, where authorised by law, to:

• Accept electronic documents;
• Create or retain electronic records;
• Issue electronic permits;
• Issue electronic licences;
• Issue electronic approvals;
• Make electronic payments; and
• Receive electronic payments.

This provides an important statutory basis for e-government services.

Public agencies may also establish requirements concerning:

• Electronic record formats;
• Electronic signatures;
• Authentication providers;
• Security;
• Integrity;
• Confidentiality; and
• Electronic payments.

Electronic Gazette

Section 27 also recognises electronic publication.

Where legislation requires publication in the Gazette, publication in the electronic Gazette can satisfy that requirement under the Act.

Certifying Agency and Authentication Services

The Act creates a regulatory framework for authentication and encryption services.

Section 30 provides for the establishment of a Certifying Agency, facilitated by the National Information Technology Agency.

The Agency’s functions include:

• Issuing licences for encryption and authentication services;
• Monitoring licensed service providers;
• Suspending licences;
• Revoking licences; and
• Arranging independent audits.

This framework is intended to create trust around services used to authenticate electronic transactions.

Licensing of Authentication Service Providers

A licence application under section 38 must be accompanied by specified documentation, including a certificate of incorporation, identification procedures and the required application fee.

The Agency can consider factors such as:

• Financial resources;
• Human resources;
• Assets;
• Hardware;
• Software;
• Operating procedures;
• Availability of information to relying parties; and
• Independent audits.

The legislation therefore treats authentication services as an area requiring technical, organisational and regulatory controls.

Consumer Protection in Electronic Transactions

One of the most commercially important sections of Act 772 concerns consumer protection.

Sections 46 to 54 establish specific rules for electronic transactions.

These provisions are particularly relevant to online retailers, digital service providers and e-commerce businesses.

Information Online Suppliers Must Provide

Section 47 requires suppliers offering goods or services electronically to make significant information available to consumers.

This includes information such as:

• Full name and legal status;
• Physical address;
• Telephone number;
• Website address;
• Relevant membership or industry bodies;
• Applicable codes of conduct;
• Registration information for legal persons;
• Characteristics of goods or services;
• Total price;
• Taxes;
• Transport costs;
• Other charges;
• Payment methods;
• Contract terms;
• Guarantees;
• Delivery period;
• Transaction records;
• Return, exchange and refund policies;
• Alternative dispute resolution arrangements;
• Security procedures;
• Privacy policies;
• Minimum duration for ongoing agreements; and
• Consumer rights.

This creates a strong transparency obligation for online businesses.

Practical Advice for E-Commerce Businesses

An online business should avoid making customers search through multiple pages to discover essential information.

A properly structured website should clearly communicate:

1. Who operates the business.
2. Where the business is located.
3. What is being sold.
4. How much it costs.
5. How payment works.
6. When delivery will occur.
7. What happens if the customer wants a refund.
8. What security measures are used.
9. What personal information is collected.
10. How customers can resolve disputes.

Businesses handling personal information should also consider the Data Protection Act, 2012 (Act 843) alongside Act 772.

Consumers Must Be Given an Opportunity to Correct Errors

Section 47 requires suppliers to provide consumers with opportunities to:

• Read contract terms;
• Store them;
• Reproduce them;
• Identify and correct handling errors; and
• Withdraw before concluding a contract.

This is particularly important for online checkout systems.

A good e-commerce platform should therefore provide a review stage before the customer finally submits an order.

Consumer Cancellation Rights

Where a supplier fails to comply with the information requirements in section 47, the consumer may cancel the contract within 14 days of receiving the goods or services.

Where cancellation occurs because of the supplier’s failure to comply, the consumer must return the goods or stop using the services where applicable, while the supplier must refund payments within 30 days.

This creates a strong incentive for online businesses to provide accurate and complete transaction information.

Secure Payment Systems

Section 47 also requires suppliers to use payment systems that are sufficiently secure, considering accepted technological standards and the nature of the transaction.

Importantly, the supplier can be liable for damage suffered by a consumer where the supplier fails to use an adequately secure payment system.

For online businesses, payment security should therefore be treated as a legal and operational responsibility, not merely a technical feature.

The cybersecurity framework should also be considered alongside the Cyber Security Act, 2020 (Act 1038) where applicable.

Delivery and Performance Requirements

Section 48 states that a supplier should execute an order within 14 days after receiving it unless the parties agreed otherwise.

Where the supplier cannot fulfil an order because the goods or services are unavailable, the consumer should be notified immediately and payment refunded within seven days after notification.

This is especially relevant to e-commerce businesses that advertise products they do not physically hold in stock.

Businesses should maintain accurate inventory information and establish clear fulfilment procedures.

The Seven-Day and Fourteen-Day Grace Periods

Section 49 provides consumers with cancellation rights for certain electronic transactions.

For goods, the consumer generally has 14 days after receiving the goods to cancel.

For services, the period is generally seven days after conclusion of the agreement.

The consumer generally does not need to provide a reason and should not face a penalty, although the direct cost of returning goods may be charged.

However, the legislation contains several exceptions.

The grace-period provision does not apply to certain transactions, including specified:

• Financial services;
• Auctions;
• Food and everyday-consumption goods supplied to the consumer’s home, residence or workplace;
• Services that began with the consumer’s consent before the grace period expired;
• Goods or services affected by financial-market fluctuations;
• Custom-made goods;
• Goods that cannot reasonably be returned;
• Perishable goods;
• Unsealed audio or video recordings or computer software;
• Newspapers and periodicals;
• Gaming and lottery services; and
• Certain accommodation, transport, catering and leisure services.

Therefore, an online seller should not assume that every product automatically carries the same cancellation rights.

Unsolicited Electronic Communications

Section 50 addresses unsolicited electronic communications.

Generally, a person should not send unsolicited electronic communications to a consumer without prior consent, subject to the statutory exception concerning certain communications from an electronic communications provider to its customer.

Commercial communications must also provide consumers with:

• An option to unsubscribe; and
• Information about the source from which their personal information was obtained when requested.

The Act also states that failing to respond to an unsolicited communication does not constitute agreement.

This is particularly important for:

• Email marketing;
• Promotional campaigns;
• SMS marketing;
• Automated marketing;
• Mailing lists; and
• Other electronic commercial communications.

Businesses should maintain proper consent and unsubscribe mechanisms.

Electronic Payment Protection

Section 51 addresses liability for misuse of an electronic payment medium.

The legislation provides certain protections to the holder of an electronic payment medium where another person uses it without authority, subject to the circumstances and exceptions established by the Act.

Consumers should nevertheless notify issuers promptly when a payment medium is lost or compromised.

Businesses and financial institutions should also maintain procedures for handling reports of lost or misused electronic payment instruments.

Restrictions on Electronic Payment Lists

Section 52 restricts financial institutions from making available, lending or selling lists containing holders of electronic payment media and their addresses and account numbers without prior written consent, except where disclosure is authorised by a court.

This provision demonstrates the Act’s concern with protecting financial information.

Protected Computers and Critical Databases

Act 772 contains special protections for computers and databases that are important to national security and essential public services.

Protected Computers

Under section 55, protected systems may include systems associated with:

• National security;
• Defence;
• International relations;
• Criminal-law enforcement;
• Communications infrastructure;
• Banking and financial services;
• Public utilities;
• Public transportation;
• Public key infrastructure;
• Public safety;
• Public health;
• Emergency services;
• Foreign commerce;
• Government services; and
• Security agencies.

Unauthorised access to a protected system is a serious offence.

Critical Databases

Sections 56 to 62 establish a framework for identifying and protecting critical databases.

A critical database may involve information important to:

• National security; or
• The economic and social well-being of the public.

The framework can address:

• Registration;
• Database management;
• Security;
• Access;
• Transfer and control;
• Integrity;
• Authenticity;
• Storage;
• Archiving;
• Disaster recovery;
• Physical security; and
• Other protective measures.

For organisations operating critical infrastructure, cybersecurity is therefore not simply an internal IT issue.

It can also have regulatory and legal consequences.

Ghana’s .gh Domain Name Registry

Act 772 also establishes a legal framework for Ghana’s country-code domain name space.

Establishment of the Domain Name Registry

Section 63 establishes a Domain Name Registry as a corporate body with perpetual succession.

The Registry is intended to operate as a non-profit entity.

Functions of the Registry

Section 64 assigns the Registry responsibility for Ghana’s country domain-name space.

Its functions include:

• Managing the .gh domain name space;
• Following international best practices;
• Licensing and regulating registries;
• Licensing and regulating registrars; and
• Publishing guidelines for domain-name administration and registration.

This makes domain-name management part of the statutory digital infrastructure of Ghana.

Domain Name Disputes

The Act also provides a dispute-resolution framework involving domain names and licensed entities.

A Dispute Resolution Committee can hear and investigate matters brought before it.

It may:

• Require witnesses to attend;
• Require documents;
• Hear evidence;
• Make declarations;
• Make interim orders;
• Dismiss trivial or vexatious matters; and
• Award reasonable costs in appropriate circumstances.

This provides an institutional mechanism for resolving certain disputes without immediately requiring every matter to proceed through ordinary court litigation.

Information and Communication Technology Tribunal

Act 772 establishes an Information Communication Technology Tribunal for appeals.

The Tribunal can hear appeals against:

• Decisions of the Agency;
• Certain orders;
• Matters arising under licences; and
• Decisions of the Dispute Resolution Committee.

A person affected by a decision generally has 28 days to file a notice of appeal under section 85.

The Tribunal may:

• Quash a decision;
• Allow an appeal;
• Vary a decision within the Agency’s lawful powers; or
• Dismiss the appeal.

A further appeal from the Tribunal lies to the Court of Appeal on a point of law, subject to the conditions set out in the Act.

Industry Forum and Industry Codes

Section 88 establishes an Industry Forum intended to bring relevant industry participants together to discuss matters of common interest.

The Forum may develop a voluntary industry code under section 89.

However, such a code does not become effective merely because the industry creates it.

It must be registered by the Agency and must be consistent with:

• The objectives of the Act;
• Regulations;
• Standards;
• Guidelines; and
• Relevant provisions of the Act.

This creates a mechanism for industry participants to contribute to the development of practical standards.

Liability of Internet Service Providers and Intermediaries

One of the more sophisticated aspects of Act 772 is its treatment of intermediaries and service providers.

The Act establishes different liability limitations depending on the role performed.

These include:

• Mere conduit;
• Electronic record transmission;
• Hosting; and
• Information location tools.

Mere Conduit

A service provider can generally avoid liability for simply transmitting, routing or providing access to electronic records where it does not:

• Initiate the transmission;
• Select the recipient;
• Select the electronic record; or
• Modify the record.

This recognises that network operators cannot necessarily be treated as publishers of every piece of information passing through their infrastructure.

Hosting

Section 92 addresses hosting providers.

A hosting provider may receive protection from liability for information stored at the request of a customer where it does not have the relevant knowledge of infringement and responds appropriately to a valid take-down notification.

This is highly relevant to:

• Web hosting companies;
• Online platforms;
• User-generated-content websites;
• Forums;
• Cloud services; and
• Other online services.

Take-Down Notifications

Section 94 provides a procedure for notifying intermediaries and service providers about allegedly unlawful electronic content.

A notification should contain information such as:

• The complainant’s name and address;
• The complainant’s signature;
• The right allegedly infringed;
• Identification of the material;
• The requested remedial action; and
• Contact information.

The Act also creates consequences for knowingly submitting a materially false notification.

This is important because a take-down system should not become a mechanism for arbitrarily removing legitimate content.

Monitoring Obligations

Section 95 provides that intermediaries and service providers generally do not have an obligation to monitor electronic records processed through a personal system merely to determine whether the processing could constitute an offence or create civil liability.

However, this does not remove obligations arising from:

• Court orders;
• Directions from competent authorities; or
• Contractual obligations.

Cyber Inspectors and Law Enforcement Powers

Act 772 gives law enforcement authorities significant powers when investigating suspected offences.

Under section 98, a law enforcement officer executing a warrant may seize:

• Computers;
• Electronic records;
• Programs;
• Information;
• Documents; and
• Other relevant items.

Section 99 also allows authorised technical assistance in certain investigations.

This may include:

• Inspecting computers;
• Searching electronic records;
• Accessing information necessary to decrypt records;
• Copying electronic evidence; and
• Obtaining technical assistance from persons responsible for computer systems.

Preservation of Electronic Evidence

Section 100 provides for preservation of records by electronic communication and remote computing service providers following a written request from law enforcement, pending a court order.

The Act establishes a 14-day period in the absence of a court order, after which the provider is no longer required to preserve the evidence under that request.

This demonstrates the importance of evidence preservation in cybercrime investigations.

Disclosure of Stored Communications

Section 101 allows a court to order disclosure of electronic communications held by an electronic communications provider where the statutory requirements are satisfied.

The court must be satisfied that disclosure is relevant and necessary for investigative purposes or is in the interest of national security.

Section 102 also establishes restrictions on disclosure of subscriber information while permitting disclosure under specified legal circumstances, including a court order.

Logs and Records

Section 103 requires providers of electronic communication or remote computing services to maintain specified logs and records for 12 months.

The information can include:

• Customer name;
• Electronic source and destination address;
• Billing records;
• Duration of service;
• Types of services;
• Related logs; and
• Platform activity as reasonably appropriate.

For service providers, this means data-retention procedures can have legal significance.

Cyber Offences Under Act 772

A substantial portion of the legislation deals with cybercrime.

The Act adapts traditional criminal concepts to electronic environments and establishes specific technology-related offences.

These include:

• Stealing;
• Electronic appropriation;
• False representation;
• Charlatanic advertising;
• Attempting to commit offences;
• Aiding and abetting;
• Conspiracy;
• Forgery;
• Criminal negligence;
• Unauthorised access;
• Electronic payment fraud;
• Electronic trafficking;
• Counterfeit-making equipment;
• Unauthorised interception;
• Unauthorised modification;
• Unauthorised disclosure of access codes;
• Denial-of-service activity;
• Unlawful access to stored communications;
• Illegal devices;
• Causing computers to cease functioning; and
• Certain offences involving child sexual abuse material.

Businesses should also distinguish these provisions from the broader framework under the Corporate Insolvency and Restructuring Act, 2020 (Act 1015) and other areas of Ghanaian commercial law.

Unauthorised Access

Section 124 criminalises intentionally accessing or intercepting an electronic record without authority or permission.

The maximum punishment stated in the supplied text is:

• A fine of up to 2,500 penalty units;
• Imprisonment for up to five years; or
• Both.

This illustrates the legal risk associated with accessing systems without permission.

Unauthorised Interference With Electronic Records

Section 125 addresses intentional unauthorised interference that causes an electronic record to be:

• Modified;
• Destroyed; or
• Otherwise rendered ineffective.

The provision carries significant penalties.

For businesses, this highlights why unauthorised manipulation of company databases, customer records or digital systems can move beyond an internal policy violation and become a criminal matter.

Unauthorised Access Devices

Section 126 addresses devices, computer programs, passwords and similar tools designed primarily to overcome security measures protecting electronic records.

The offence can apply to activities such as:

• Producing;
• Selling;
• Offering for sale;
• Procuring;
• Designing;
• Adapting;
• Distributing; or
• Possessing such tools unlawfully.

This is significant because the Act is not limited to the final act of hacking.

Certain preparatory activities involving prohibited security-bypass tools can themselves create criminal liability.

Denial-of-Service Attacks

Section 128 specifically addresses conduct intended to interfere with access to an information system and cause a denial or partial denial of service to legitimate users.

This covers conduct commonly associated with denial-of-service attacks.

The maximum penalty stated in the supplied text is a fine of up to 2,500 penalty units or imprisonment of up to two years, or both.

Unauthorised Modification

Section 131 criminalises unauthorised modification of computer programs or electronic records.

A modification can include:

• Altering information;
• Erasing information;
• Adding information;
• Removing information; or
• Causing an act that impairs normal computer operation.

Importantly, the Act states that the modification does not have to be permanent.

This means temporary interference can potentially be legally significant.

Unauthorised Disclosure of Access Codes

Section 132 creates a particularly serious offence involving unauthorised disclosure of passwords, access codes or other means of accessing computer programs or electronic records.

The supplied text provides a maximum penalty of:

• A fine of up to 10,000 penalty units;
• Imprisonment for up to 20 years; or
• Both.

This illustrates the seriousness with which the legislation treats access credentials.

Businesses should therefore maintain strict controls over:

• Passwords;
• Administrator accounts;
• API credentials;
• Authentication tokens;
• Encryption keys; and
• Other access mechanisms.

National Security and Protected Computers

Section 133 contains particularly severe provisions relating to unauthorised access to protected computers and certain sensitive information.

The provision covers information associated with areas such as:

• Financial institutions;
• Government agencies;
• Protected computers; and
• Ghana’s national security.

The maximum punishment stated in the supplied text can reach 20 years’ imprisonment, together with a fine of up to 10,000 penalty units.

Computer Viruses and Worms

Section 134 makes it an offence to intentionally engage in conduct, including virus writing and dissemination of viruses or worms, that causes a computer to cease functioning temporarily or permanently.

This reflects the Act’s recognition that malicious software can cause serious economic and operational harm.

Illegal Devices

Section 135 deals with devices and computer programs designed or adapted for committing offences, as well as passwords and access codes intended to facilitate criminal access.

This provision is particularly relevant to cybersecurity professionals.

The distinction between legitimate security testing and unlawful activity can depend heavily on authorisation, purpose and circumstances.

Organisations conducting penetration tests or security assessments should therefore ensure that the scope of testing is clearly authorised.

Child Sexual Abuse Material

Section 136 criminalises specified activities involving child pornography through computer systems.

The provision covers activities such as:

• Publishing;
• Producing or procuring for publication; and
• Possessing such material on a computer or electronic storage medium.

The Act defines a child for this purpose as a person below 18 years.

This is one of the most serious categories of conduct addressed by the legislation.

Confiscation and Compensation

Cybercrime can cause financial and technological damage beyond the criminal offence itself.

Section 137 allows a court, following conviction, to order confiscation of money, property and assets acquired from proceeds of an offence.

Section 138 allows courts to order compensation for damage caused to:

• Computers;
• Programs; or
• Electronic records.

The victim may also retain rights to pursue civil remedies for damages beyond the compensation awarded under the Act.

This is important for businesses because a cybercrime incident can create both criminal and civil consequences.

Territorial Reach of the Act

Section 142 gives the Act significant territorial reach.

It can apply to persons outside Ghana in specified circumstances.

Relevant connections can include situations where:

• The accused was in Ghana at the relevant time;
• The electronic payment medium, computer or electronic record was issued, located or stored in Ghana;
• A payment medium was issued by a Ghanaian financial institution; or
• The offence occurred in Ghana or in specified circumstances involving Ghanaian registered ships or aircraft.

This reflects the inherently cross-border nature of cybercrime.

A cyber offence does not necessarily become legally irrelevant simply because the person responsible is physically outside Ghana.

Why Act 772 Matters to Businesses

For businesses, the Electronic Transactions Act should be viewed as more than a technology law.

It affects several areas of ordinary commercial activity.

1. Online Contracts

Businesses can form contracts electronically, but they should maintain reliable records showing:

• What terms applied;
• When the agreement was made;
• Who accepted it;
• How acceptance occurred; and
• What records were generated.

2. Electronic Record Keeping

Companies should establish clear systems for retaining important electronic records.

This can include:

• Contracts;
• Invoices;
• Payment records;
• Customer communications;
• Orders;
• Delivery records;
• Electronic approvals; and
• Audit logs.

3. Digital Signatures

Where digital signatures are used, businesses should have procedures for verifying them and maintaining evidence of their authenticity.

4. E-Commerce Compliance

Online sellers should clearly display:

• Business identity;
• Contact information;
• Prices;
• Delivery terms;
• Refund policies;
• Contract terms;
• Security policies; and
• Other required consumer information.

5. Cybersecurity

Companies should take reasonable measures to protect:

• Customer information;
• Payment information;
• Passwords;
• Internal systems;
• Databases;
• Backups; and
• Electronic records.

6. Marketing Compliance

Email and other electronic marketing should incorporate appropriate consent and unsubscribe mechanisms.

7. Incident Response

Businesses should have an incident-response plan for:

• Hacking;
• Data destruction;
• Credential theft;
• Malware;
• Payment fraud;
• Unauthorised access; and
• System disruption.

Businesses should also understand how the Electronic Communications Act, 2008 (Act 775) may interact with electronic communications and technology-related operations.

Practical Compliance Checklist for an Online Business

A Ghanaian online business can use the following checklist as a starting point.

Business information

• Display the legal name of the business.
• Provide a physical address.
• Provide telephone and email contact details.
• Provide relevant registration information.
• Clearly identify the goods or services being sold.

Businesses can verify relevant corporate information through an entity information search in Ghana where appropriate.

Pricing

• Clearly display the full price.
• Identify applicable taxes.
• Identify delivery charges.
• Identify additional fees.

Contracts

• Make terms and conditions available before purchase.
• Allow customers to retain or reproduce the terms.
• Give customers an opportunity to identify errors.
• Clearly explain cancellation rights.
• Maintain transaction records.

Payments

• Use appropriate payment security.
• Protect payment information.
• Restrict employee access to payment systems.
• Monitor suspicious transactions.

Consumer protection

• Publish refund and return policies.
• State expected delivery times.
• Provide appropriate cancellation mechanisms.
• Handle complaints systematically.

Electronic records

• Maintain reliable electronic records.
• Keep records accessible.
• Protect record integrity.
• Maintain appropriate backups.
• Preserve relevant metadata and audit trails.

Cybersecurity

• Use strong authentication.
• Restrict administrator access.
• Maintain software updates.
• Protect backups.
• Monitor suspicious access.
• Have a procedure for responding to security incidents.

What Consumers Should Know

Consumers also have an important role under Act 772.

Before purchasing from an online supplier, consumers should look for:

• The supplier’s legal identity;
• Physical address;
• Contact information;
• Full price;
• Delivery terms;
• Refund policy;
• Privacy and security information;
• Payment methods;
• Contract terms; and
• Complaint or dispute-resolution information.

Consumers should also retain important evidence of online transactions.

This could include:

• Order confirmations;
• Emails;
• Receipts;
• Screenshots;
• Payment confirmations;
• Delivery records; and
• Relevant terms and conditions.

Because electronic records can be used as evidence, preserving transaction information can become valuable if a dispute arises.

The Broader Importance of Act 772

The Electronic Transactions Act represents an important legal shift from a paper-centred commercial environment toward a digital economy.

Its provisions address the full lifecycle of electronic activity.

The legislation covers:

Creation → Signing → Transmission → Receipt → Storage → Evidence → Consumer protection → Regulation → Enforcement → Cybercrime

That broad coverage is one of the Act’s most important characteristics.

It does not merely say that an email or electronic contract can be valid.

It attempts to establish an ecosystem in which electronic commerce can operate with greater legal certainty.

Key Takeaways

The most important lessons from Ghana’s Electronic Transactions Act, 2008 include the following:

1. Electronic records can satisfy certain legal writing requirements.
2. Electronic records can be admissible as evidence.
3. Digital signatures can satisfy certain signature requirements.
4. Electronic contracts can be legally valid.
5. Automated transactions can be legally recognised.
6. Electronic records subject to retention requirements may need to be maintained for at least six years.
7. Government agencies can accept and issue electronic documents and payments in appropriate circumstances.
8. Online suppliers have extensive information obligations toward consumers.
9. Consumers receive specific cancellation and protection rights for qualifying electronic transactions.
10. Unsolicited commercial electronic communications are regulated.
11. Certain computers and databases receive enhanced protection.
12. Ghana’s .gh domain-name space is subject to a statutory regulatory framework.
13. Internet intermediaries and service providers receive conditional limitations on liability.
14. Law enforcement authorities have powers to preserve, obtain and examine electronic evidence under the Act.
15. Unauthorised access, interference, fraud, malware, denial-of-service activity and other cyber offences can result in criminal penalties.
16. The legislation can apply to certain conduct involving persons and systems outside Ghana.

Final Thoughts

Ghana’s Electronic Transactions Act, 2008 (Act 772) provides a comprehensive legal framework for the country’s digital economy. Its importance extends from a simple online purchase to sophisticated electronic authentication systems, government services, domain-name administration, digital evidence and cybercrime investigations.

For businesses, the central lesson is that moving operations online does not remove legal obligations. An online store, digital platform, software company, payment service, hosting provider or other technology business must consider the legal consequences of how it collects information, forms contracts, processes payments, communicates with customers and protects electronic records.

For consumers, the Act provides important protections concerning transparency, electronic contracting, payment security, delivery, cancellation and unsolicited communications.

For technology professionals and cybersecurity teams, the legislation demonstrates that unauthorised access, interference, credential disclosure, malicious software and attacks against protected systems can have serious legal consequences.

Ultimately, compliance should not be treated as a document that is prepared once and forgotten. Digital businesses should build compliance into their website design, transaction processes, record-keeping systems, cybersecurity controls, customer service procedures and contractual practices.

Because Act 772 interacts with other Ghanaian legislation and regulatory frameworks, organisations dealing with high-value transactions, regulated industries, sensitive data, government systems or potential disputes should obtain current professional legal advice before relying on a particular provision.