CSA fines ORC, Purpleline Solutions GH¢360,000 for cybersecurity non-compliance

The Cyber Security Authority (CSA) has imposed a combined fine of GH¢360,000 on the Office of the Registrar of Companies (ORC) and Purpleline Solutions Limited for violating Ghana's cybersecurity licensing regulations. The ORC was sanctioned for its decision to engage Purpleline Solutions, an unlicensed Cybersecurity Service Provider (CSP), despite being instructed to work with a Tier 1 licensed provider.

This breach, in conjunction with failing to comply with two separate directives, resulted in the ORC being fined 10,000 penalty units for each violation, leading to a total of GH¢240,000. The CSA also fined Purpleline Solutions GH¢120,000 for providing cybersecurity services without the necessary license. It is crucial to note that merely submitting a licence application does not grant authorization to commence regulated cybersecurity services; a valid licence is a prerequisite for such operations.

The Authority has cautioned public institutions, designated Critical Information Infrastructure operators, and other organizations subject to the Cybersecurity Act against engaging unlicensed cybersecurity service providers. It emphasized that cybersecurity licensing is a legal requirement and not an administrative task. The CSA has vowed to maintain vigilance in enforcing compliance and taking enforcement actions against both entities that utilize unlicensed providers and those operating without the requisite license.