Cybersecurity Act, 2020 (Act 1038)

This section says the Act applies to cybersecurity activities in the country.

This section establishes the Cyber Security Authority as a body corporate and gives it power to handle property and contracts.

The Authority’s objects are to regulate and coordinate cybersecurity activities, including threats, incidents, critical information infrastructure, awareness, and collaboration.

The Authority must carry out cybersecurity governance functions such as advising, monitoring threats, setting standards, certifying products and services, issuing licences, and supporting incident response.

The Authority’s governing body is a Board made up of specified ministers, the Director-General, Industry Forum nominees, and other presidential appointees; the President also nominates the chairperson and appoints the Board members.

The Board must oversee the Authority, set its strategic direction and policies, manage and disburse the Cybersecurity Fund under section 30, and ensure the Authority performs its functions efficiently and effectively.

Board members serve for four years, may resign in writing, and can be removed or replaced when vacancies arise.

The Board must meet at least quarterly. The chairperson must call extraordinary meetings on a written request from at least one-third of members, preside at meetings, and may determine time and place; a substitute member may preside if the chairperson is absent. A co-opted attendee may not vote.

A Board member with an interest in a matter must disclose it in writing and must not take part in the Board’s deliberations on that matter.

The Board may set up committees. Mixed committees must be chaired by a Board member, and committees made up only of non-members are advisory.

Board members and committee members are to be paid allowances set by the Minister, after consulting the Minister responsible for Finance.

The Minister may issue written policy directives to the Board, and the Board must comply.

This section establishes the Joint Cybersecurity Committee and sets rules for its membership, meetings, quorum, voting, allowances, sub-committees, and secretariat.

The Joint Cybersecurity Committee must work with the Authority and represented sectors or institutions to implement relevant cybersecurity measures, and it is answerable to the Board for its office functions.

The President must appoint a Director-General for the Authority, and the appointee must meet the stated qualifications.

The Director-General manages the Authority’s day-to-day administration, answers to the Board, implements Board decisions, and may delegate functions but stays ultimately responsible.

The Authority must appoint a qualified Secretary to the Board, and the Secretary must carry out Board-directed administrative duties and answer to the Board.

The President must appoint inspectors for the Authority, and inspectors must meet specified qualifications and are not subject to direction or control when performing functions under the Act.

Inspectors must use orders, warrants, and retained or retrieved data only for the purposes for which they were issued or obtained, and they must submit quarterly inspection reports to the Board.

The President must appoint necessary staff for the Authority, public officers may be transferred or seconded to it or assist it, and the Authority may hire consultants and advisors on the Board’s recommendation.

The Board may create divisions of the Authority when needed for efficient and effective performance, and each division must be headed by a director.

The Authority must maintain an Internal Audit Unit, headed by an Internal Auditor, and that auditor must report every three months.

The Authority’s funds come from several listed sources, including Parliament-approved moneys, administrative penalties, internally generated funds, and amounts approved by the Minister for Finance or the Board.

The Authority must pay its moneys into a bank account opened for that purpose, with approval from the Controller and Accountant-General.

The Authority may borrow money and obtain other credit facilities, if the Government guarantees them and the Minister responsible for Finance approves the lender.

The Authority’s expenses must be paid from the Authority’s own funds.

The Board must keep accounting records in the form approved by the Auditor-General and submit the Authority’s accounts for audit at the end of the financial year.

The Board must submit an annual report to the Minister within 30 days after receiving the audit report, and the Minister must forward it to Parliament within 30 days after receiving it.

This section establishes a Cybersecurity Fund under the Act.

The Fund exists to finance cybersecurity improvements for the country.

This section lists the possible sources of money for the Fund, including Parliament-approved seed money, amounts payable to the Authority for the Fund, grants and donations, charges set by the Authority, fees from government e-services, a possible parliamentary levy on e-services, and other Parliament-approved money.

Fund money must be paid into a bank account opened by the Authority for that purpose, with the approval of the Controller and Accountant-General.

The Board is responsible for managing the Fund.

Money from the Fund must be disbursed according to the Fund’s policy guidelines.

The Minister may designate a computer system or computer network as critical information infrastructure, but must publish the designation in the Gazette and consider listed security, public service, and national interest factors.

The Authority must register critical information infrastructure and publish registration requirements and procedure in the Gazette. If registered infrastructure changes ownership, the owner must tell the Authority within 7 days. Failure to do so can lead to an administrative penalty under the Second Schedule.

The Minister may withdraw a critical information infrastructure designation, but only on the Authority’s advice and by publication in the Gazette, if the system or network no longer meets the criteria.

The Minister must set minimum standards for prohibitions linked to critical information infrastructure, and the Authority must conduct periodic audits and inspections for compliance.

The owner of a critical information infrastructure must report cybersecurity incidents within 24 hours of detection, arrange an audit, and send the audit report to the Authority.

A person must not, without authorisation, access or try to access a critical information infrastructure computer system or network.

This section establishes the National Computer Emergency Response Team.

The National Computer Emergency Response Team must respond to cybersecurity incidents, coordinate responses among public and private institutions and international bodies, and oversee the Sectoral Computer Emergency Response Team.

The Authority must equip the National Computer Emergency Response Team with the tools it needs and support cooperation with other countries’ sectoral emergency response teams. It may also issue regulatory directives to Sectoral Computer Emergency Response Teams, which must comply.

The Authority must create sectoral computer emergency response teams by Gazette notice, oversee them, and set reporting templates; the teams must send monthly reports and may be penalized for noncompliance.

The Authority may set up a cybersecurity incident monitoring and response system and must put in place technical measures to make it effective.

The Authority must establish and implement an early warning system for human-initiated risks that could undermine the country’s cybersecurity and use it to advise the public on cybersecurity matters.

Several actors must report cybersecurity incidents, and the Authority must set up a reporting and information-sharing platform.

The Authority must create a cybersecurity incident point of contact. Certain institutions must report incidents through it, and individuals may also use it to report incidents.

A person may not provide a cybersecurity service unless licensed by the Authority.

Anyone who wants to provide a cybersecurity service must apply in writing to the Authority, using the prescribed form and paying any prescribed fee, and the Authority must acknowledge the application within 14 days.

The Authority may grant a licence if the applicant meets the Authority’s requirements and the grant is not against the public interest. It must notify applicants of decisions within 30 days and give refusal reasons within 28 days. A licensed cybersecurity service provider that uses a licence for another purpose must pay the administrative penalty in the Second Schedule.

A person who is granted a licence must not transfer it to someone else.

A licence under this Act lasts for two years. A licensed cybersecurity service provider that wants to keep operating must apply in writing to the Authority for renewal at least one month before the licence expires.

The Authority may suspend a licence for up to six months if the licensee does not renew it in time or breaches a licence condition.

The Authority may revoke a licence for specified misconduct or other disqualifying circumstances, and must publish the revocation in the Gazette.

A person dissatisfied with a decision may seek review by complaint to the Board, then the Minister, and finally by court action, each within 28 days of receipt of the relevant decision.

The Authority must establish a mechanism to accredit cybersecurity professionals and practitioners.

The Authority must set up a certification mechanism for cybersecurity products and technology solutions.

The Authority must develop and publish cybersecurity standards, promote their adoption, enforce them, and monitor compliance. A person who breaches the standards must pay the administrative penalty in the Second Schedule.

The Authority must carry out programmes to promote public awareness and education on cybersecurity.

The Authority must create and carry out a cybersecurity research and development programme, build a qualification framework for cybersecurity trainers and institutions, develop or implement technology solutions to address cybersecurity threats, and work with research centres and other institutions.

A person must not take, produce, publish/stream, or possess an indecent image or photograph of a child.

A person must not use certain electronic services or devices to groom, solicit, lure, entice, or attempt to do so with a child for unlawful sexual conduct.

Operators of certain online services must not help or allow child sexual solicitation or unlawful sexual conduct involving a child.

A person must not use electronic services or devices to spread a child’s identifying information to arrange a meeting for sexual purposes.

A person must not threaten to share intimate or private sexual images to harass, coerce, extort, or force unwanted sexual activity.

A person must not intentionally share, or cause someone else to share, another identifiable person’s intimate image or prohibited visual recording without consent and where privacy was reasonably expected; doing so is an offence.

A person must not threaten to distribute a prohibited intimate image or visual recording if the threat would cause distress and fear; violating this is an offence punishable by 1 to 3 years’ imprisonment on summary conviction.

An investigative officer may apply ex parte to the High Court for a production order to collect subscriber information.

The High Court may issue a production order for subscriber information if strict conditions are met, and the service provider must keep the order confidential.

A senior investigative officer authorised by a designated officer may apply ex parte to the High Court for an interception warrant for traffic data, but must support the application with specified details and privacy-related measures.

The High Court may grant an interception warrant for traffic data if stated conditions are met, and service providers must keep the warrant and its execution confidential.

A designated officer may apply ex parte to the High Court for an interception warrant to collect or record content data.

The High Court may issue an interception warrant for content data if listed safeguards and necessity conditions are met; the service provider must intercept, provide the data immediately, and keep the warrant confidential.

A production order or interception warrant lasts for the period stated in it and can be extended.

The Authority can require a service provider to install interception capability, and the provider must meet specified security, staffing, decryption, cost, and location restrictions.

Service providers must keep certain data for set periods, may seek a High Court extension for traffic and content data beyond 12 months, and must not use retained data for purposes not stated in an interception warrant.

The Court may freeze assets and require disclosures if the Authority applies and the Court suspects an offence under the Act or a cybercrime.

If a freezing order under section 78 is in place and not discharged or appealed, the Court may order the Attorney-General to manage, possess, dispose of, or receive payment for the property, and may require a possessor to hand it over.

The Court must direct how realised proceeds are split: 70% to the Authority, 10% to the Office of the Attorney-General, and the remainder to the Consolidated Fund.

This section creates an Industry Forum, lets the Authority name or remove a facilitator, and allows industry participants and officials to take part.

An Industry Forum may prepare a voluntary industry code, but it only takes effect when the Authority registers it.

The Authority must promote cyberspace security through international cooperation and maintain a 24/7 contact point for cybercrime assistance.

Board members and officers of the Authority are immune from civil liability for good-faith actions or omissions while performing the Authority’s functions.

The Authority must create and keep an electronic Cybersecurity Risk Register, and it must protect the information in it from disclosure except in limited cases.

The Authority may direct certain infrastructure operators, sectoral response teams, and service providers in writing to give relevant information for cybersecurity purposes.

The Authority may, on a court order, authorise a service provider to block, filter, or take down illegal content and certain phone numbers used maliciously to undermine cybersecurity.

Public and private institutions must cooperate with the Authority to help ensure the country's cybersecurity.

Specified Authority leaders and staff must take an oath before taking office and must not disclose Authority information except in listed cases.

The High Court may try offences under this Act and other matters arising under it, and procedural powers from the Electronic Transactions Act, 2008 and other applicable laws apply.

The Authority must publish guidelines it considers necessary for critical information infrastructure matters.

The Authority may issue directives to critical infrastructure owners and cybersecurity service providers, and those who do not comply may have to pay an administrative penalty.

When imposing an administrative penalty under this Act, the Authority must consider the service provider’s size, the sector’s criticality, the impact of the contravention, and any other relevant criterion set by the Minister.

A person must not, without lawful authority, retrieve subscriber information or intercept traffic data or content data.

A person who breaks a section of the Act that has no specific penalty commits an offence and can be fined, imprisoned, or both.

The Minister may make regulations, by legislative instrument, about the matters listed in this section.

This section defines key terms used in the Act, including “Authority,” “Board,” “child,” “computer,” “computer system,” and several cybersecurity-related terms.