Ghana is quietly advancing one of the most expansive internet governance laws in West Africa. The Ghana Domain Name Registry Bill, 2025, introduced to establish a national body to manage the country’s .gh domain name space, contains provisions that go well beyond administrative housekeeping.
Buried inside a framework that looks, on the surface, like routine digital infrastructure legislation, are powers to seize websites, block domain names, compel internet service providers to cut off services — and do it all through a body that answers, ultimately, to the President.
The bill is currently under drafting and legislative review.
One Registry to Rule Them All
At its core, the bill establishes the Ghana Domain Name Registry as the sole authority over the country’s .gh domain space. That part is uncontroversial. Most countries have a national registry, and formalising Ghana’s has been a long time coming. What is controversial is what that registry can do once established.
The Registry would be the only body authorised to administer .gh domains, license registrars, and maintain the central database of domain names.
Any person or entity operating outside this framework commits a criminal offence, punishable by fines or up to three years in prison. That is a reasonable boundary. The problems begin when the bill turns to enforcement.
Every Business, One Domain — Or Else
Section 21 mandates that every legally registered or operating entity in Ghana must register a .gh domain name for any public-facing website and use it for all official digital correspondence.
Not encouraged. Not incentivised. Required. Entities currently using non-.gh domains — which includes the vast majority of Ghanaian businesses, NGOs, and media organisations — have six months from the law’s commencement to comply.
The penalties for non-compliance escalate sharply. Entities that fail to switch face administrative fines, suspension or revocation of their business licences, and disqualification from public procurement for up to two years. Directors of non-compliant companies face personal liability. For a small fintech startup or an independent news outlet, these are existential consequences.
The six-month deadline alone presents a significant operational challenge. Migrating a domain, rebuilding SEO, updating payment systems, and re-registering across digital platforms is not a weekend project — it is months of technical and legal work.
The bill offers no phased timeline, no support mechanism, and no clarity on how “operating in the Republic” is defined for foreign companies with partial Ghanaian operations.
A Regulator With a Judge’s Powers
The bill’s most alarming provisions are in Section 26. The Registry — a regulatory body, not a law enforcement agency — is granted the power to apply to the High Court for orders to seize, block, or deactivate domain names; compel ISPs to cease services to offending domains; and authorise physical entry into premises to inspect digital systems on the basis of “reasonable suspicion.”
These are extraordinary powers. In most jurisdictions, domain seizure and ISP compulsion orders of this kind require law enforcement involvement, prosecutorial oversight, or at minimum a regulatory framework with robust procedural safeguards.
In this bill, they flow from a body whose entire board is appointed by the President, and whose Executive Director is also a presidential appointee.
The independence problem is structural, not incidental. The Minister for Communications can issue binding policy directives to the Registry at any time. The Registry can then expand its own definition of what constitutes abuse — the bill’s definition is explicitly left open-ended — and use that expanded definition to trigger enforcement action against a domain name.
That chain of authority, from the executive to a directive-compliant Registry to a court order against a website, is not theoretical. It is baked into the legislation as written.
Adjudicating Its Own Disputes
The bill also establishes a Dispute Resolution Committee to handle conflicts between the Registry and registrars or registrants. The committee is appointed by the Registry’s own Board.
A body that is a party to certain disputes simultaneously controls the appointment of those who adjudicate them — a fundamental violation of natural justice principles that no High Court appeal mechanism fully corrects.
A Surveillance Architecture
Section 20 requires all government ministries, district assemblies, and security agencies to integrate their domain names into a centralised DNS Security Operations Centre managed by the Registry.
The stated purpose is cybersecurity — monitoring for phishing, DNS hijacking, and other threats. That is legitimate. What is absent is any data protection safeguard, any independent oversight mechanism, or any limitation on what intelligence gathered through that monitoring can be used for.
Ghana’s Data Protection Act exists, but its enforcement infrastructure is thin. The gap between legislative intent and operational reality here is wide.
The Stakes
Ghana has a functioning democracy and a relatively free press by regional standards. The Domain Name Registry Bill, if passed in its current form, would hand the executive branch an administrative mechanism capable of removing any organisation’s online presence with a court order initiated by a body it controls.
That the bill also contains legitimate provisions — DNS security, SME digital inclusion funding, formalised registrar licensing — makes it harder, not easier, to push back on the parts that warrant scrutiny.
