Ghana Data Protection Act 2012: What Businesses Need to Know

Ghana enacted its Data Protection Act (DPA) in 2012, making it one of the first sub-Saharan African countries to introduce comprehensive data protection legislation. Administered by the Data Protection Commission (DPC), the Act applies to any person or organisation that collects, processes or holds personal data in Ghana - and increasingly to foreign organisations targeting Ghanaian residents. Here is what your business needs to know.

Overview and scope of the Act

The Ghana Data Protection Act 843 of 2012 governs the collection, processing, storage, use and disclosure of personal data. Its primary purpose is to protect the privacy rights of individuals in Ghana.

The Act applies to data controllers - any person, company or organisation that determines the purposes and means of processing personal data. It applies regardless of where the data controller is based, provided the processing occurs in Ghana or relates to persons in Ghana.

• Any business with employees or customers in Ghana is subject to the Act
• Foreign businesses processing personal data of Ghanaian residents must comply
• Both automated and manual processing are covered
• Special category data (health, financial, biometric) attracts heightened obligations

The Data Protection Commission

The Data Protection Commission (DPC) is the independent regulatory body responsible for administering the Act. The DPC maintains the data protection register, investigates complaints, issues enforcement notices, and can impose penalties for non-compliance.

The DPC has taken an increasingly active enforcement stance in recent years. Businesses should monitor DPC guidance and update their practices accordingly, as the Commission regularly publishes guidelines on specific processing activities.

Registration requirements

All data controllers in Ghana are required to register with the Data Protection Commission before processing personal data. Registration is not optional - operating without registration is an offence under the Act.

• Complete the registration application on the DPC's online portal
• Provide details of the categories of personal data processed, the purposes, and the classes of data subjects
• Pay the applicable registration fee (fees vary by organisation type and size)
• Renew registration annually - the DPC issues reminders, but the obligation rests with you
• Display your registration certificate as required

Failure to register carries penalties including fines and potential criminal liability. The DPC publishes a public register of all registered data controllers.

Key obligations for businesses

Registered data controllers must meet ongoing obligations under the Act:

• Lawfulness: Personal data must be collected and processed lawfully, fairly and transparently
• Purpose limitation: Data collected for one purpose cannot be used for an incompatible purpose without fresh consent
• Data minimisation: Only collect the data you actually need for the specified purpose
• Accuracy: Take reasonable steps to keep personal data accurate and up to date
• Retention: Do not keep personal data longer than necessary for the purpose it was collected
• Security: Implement appropriate technical and organisational measures to protect personal data
• Data subject rights: Respond to access requests, correction requests and objection to processing

The Act also requires data controllers to appoint a data protection officer where processing is on a large scale or involves sensitive categories of data. Cross-border transfers of personal data outside Ghana require appropriate safeguards.

Enforcement and penalties

Non-compliance with the Data Protection Act can result in enforcement notices from the DPC, administrative fines, and in serious cases, criminal prosecution. The DPC has authority to conduct audits and inspections of data controllers' practices.

Practical steps to take now: register with the DPC if not already done; conduct a data inventory to map all personal data you hold relating to Ghanaian residents; review your privacy notices for Ghana-based processing; ensure you have appropriate security measures in place; and document your compliance posture.

Back to all guides