ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXData Protection Act, 2012 (Act 843)
Ghana
In force since 2012
Data Protection Act, 2012 (Act 843), effective 16 October 2012
Data Protection Commission (DPC)
Asia & Africa
Ghana
Data Protection Act, 2012 (Act 843)
In force
16 October 2012
Data Protection Commission (DPC)
Data controllers and data processors
Data controllers generally need to register before processing personal data
An important justification, but not the only lawful basis
Enhanced protection
A certified and qualified supervisor who monitors compliance
Relevant to significant privacy risks and DPC compliance
Access, objection, direct-marketing controls, correction, blocking, erasure and destruction, where applicable
Assessment and safeguards
Investigation, inspection, notices and compliance enforcement
Specific penalties for particular offences; a general maximum under Section 95 where no specific penalty applies
Draft Data Protection Bill, 2025, which is not current operative law
Act 843 applies to data controllers and data processors that process personal data within its statutory scope. It covers controllers established in Ghana that process personal data in Ghana, and it can also reach controllers outside Ghana that use equipment, or a data processor carrying on business, in Ghana to process personal data, other than for the purpose of transit through Ghana.
Act 843 sets specific penalties for particular offences, so no single maximum applies to every contravention. Processing personal data without registering as a data controller, and failing to comply with certain notices issued by the Commission, each carry their own penalty. Where no specific penalty is provided, Section 95 sets a general penalty of a fine of not more than five thousand penalty units, imprisonment of not more than ten years, or both. The Data Protection Commission can also investigate complaints, carry out inspections and issue notices requiring an organization to take steps to comply.
In practice, purpose limitation, data minimization, transparency and security are central compliance considerations. Organizations should collect only the personal data that is adequate, relevant and not excessive for a defined purpose, explain that purpose clearly, and protect the data throughout its lifecycle.
The Data Protection Act, 2012 (Act 843) establishes the legal framework for protecting personal data in Ghana. It regulates the collection, use, disclosure, storage, security and destruction of personal data, and it addresses:
The Data Protection Commission is the regulator established by the Act. It maintains the register of data controllers, monitors compliance, investigates complaints, takes enforcement action and promotes awareness of data protection in Ghana.
Consent is important, but Ghana's DPA is not a consent-only law. Section 20 provides for consent and for specified alternative justifications, so each processing activity should rest on the justification that actually fits it.
A data controller determines the purposes for which, and the manner in which, personal data is processed. Controllers carry primary responsibility for compliance, including registration with the DPC. Examples include:
A data processor handles personal data on behalf of a controller, following the controller's instructions. Examples include:
Act 843 applies to data controllers established in Ghana that process personal data in Ghana. It can also apply to controllers not established in Ghana that use equipment, or a data processor carrying on business, in Ghana to process personal data, other than for the purpose of transit through Ghana.
Section 18 also addresses foreign data subjects. Where personal data originating from a foreign jurisdiction is sent into Ghana for processing, the data controller must ensure that the data is processed according to the data protection legislation of that foreign jurisdiction.
International organizations should therefore assess Ghanaian requirements alongside the other privacy laws that apply to their data subjects, systems and service providers.
Under Act 843, personal data is data about an individual who can be identified from that data, or from that data together with other information that the data controller holds or is likely to obtain. Examples include:
Whether a technical identifier, such as a cookie ID or device identifier, is personal data depends on whether it can be linked to an identifiable individual in context.
Section 20 provides that personal data should not be processed without the prior consent of the data subject unless another specified justification applies. Consent is not the only justification. Processing may also rely on:
Organizations should document the justification relied on for every processing activity. A documented justification shows why the processing is permitted, determines whether consent must be collected and recorded, and shapes how objections and rights requests are handled.
Where consent is the applicable justification, it should be:
A digital consent interface should communicate:
Act 843 gives data subjects the right to object to the processing of their personal data where applicable, and processing should stop where an objection is valid. Where consent is the basis for processing, people should also be able to withdraw it.
These rights only work if operational workflows support them. Organizations should maintain:
Act 843 gives enhanced protection to special personal data, which includes information about:
Before processing special personal data, organizations should assess:
Openness is one of the Act's principles. A privacy notice should explain:
Act 843 gives individuals rights over their personal data. Each right applies where applicable and subject to statutory conditions.
A practical workflow for handling access and other rights requests:
ConsentX can support privacy request workflows by organizing intake, tracking status and keeping records. The software does not determine legal outcomes; decisions about exemptions and responses remain with the organization.
Act 843 lets individuals require a data controller to stop, or not to begin, processing their personal data for direct marketing. This affects:
ConsentX preference management helps organizations capture marketing choices, keep records of consents and opt-outs, and pass updated preferences to connected systems so suppressed contacts are not targeted.
Automated processing, including profiling, raises specific privacy considerations:
Profiling and automated decision-making may warrant a DPIA, depending on the processing and the applicable requirements.
A Data Protection Impact Assessment (DPIA) is a proactive privacy-risk assessment. It identifies how a processing activity could affect individuals and which measures reduce those risks before processing begins.
A DPIA may be relevant for:
Section 58 provides for a data controller to appoint a certified and qualified person as a Data Protection Supervisor to monitor the controller's compliance with the Act.
An effective Data Protection Supervisor should have:
Controllers should take appropriate, reasonable technical and organizational measures to protect personal data against:
Practical measures include:
A practical breach-response process:
Act 843 does not set a universal 72-hour breach-notification deadline. Organizations should assess notification to the DPC and to affected individuals where required under the current Act.
Any breach-notification timelines in the draft Data Protection Bill, 2025 are proposals only. They should not be treated as current obligations unless and until replacement legislation formally enters into force.
Data controllers are generally required to register with the Data Protection Commission before processing personal data. A registration application may include:
Under Act 843, processing personal data without registering as a data controller is an offence, punishable on summary conviction by a fine, imprisonment or both, as specified in the Act. Organizations should confirm the applicable penalty with their legal advisers.
Act 843 includes an assessable-processing framework. Processing that may cause substantial damage or substantial distress to a data subject, or significantly prejudice the privacy rights of a data subject, may be subject to additional review by the DPC.
Organizations planning high-risk processing should consider whether this framework applies before the processing begins.
Before transferring personal data outside Ghana, organizations should assess the applicable requirements, including:
DPC registration information includes the countries to which a data controller intends to transfer personal data, so transfer arrangements and registration details should stay aligned.
Retention should be connected to the purpose for which personal data was collected and to any applicable legal requirements. A retention program should cover:
Controllers remain responsible for personal data processed by third parties on their behalf. Vendor agreements should address:
Privacy is easier to achieve when it is built into products and processes from the beginning. Useful practices include:
Act 843 regulates the processing of personal data. It does not create a universal, one-size-fits-all cookie rule. Websites and apps commonly use:
Organizations should determine whether each tracking technology processes personal data and, where it does, identify the appropriate legal justification under the Act.
Where consent is the applicable legal basis for tracking, the following controls help make that consent meaningful:
ConsentX supports technical enforcement of these choices. Prior-script blocking stops applicable trackers from running until the visitor has given consent, and preference management lets visitors change their choices at any time.
Organizations should be able to produce evidence of compliance, including:
Ghana's Data Protection Commission is responsible for:
The Commission can investigate complaints, carry out inspections and issue notices requiring organizations to take steps to comply with the Act.
Act 843 contains specific offences with their own penalties. No single maximum applies to every offence. The Act distinguishes between:
Organizations should check the penalty attached to each specific provision rather than assuming the Section 95 maximum applies.
The Data Protection Bill, 2025 is a draft replacement proposal for Act 843.
Consent management is one component of Ghana's broader privacy framework, alongside registration, security, data-subject rights and governance. Where consent is relied on, organizations should be able to demonstrate:
ConsentX connects these questions to technical controls: prior-script blocking enforces choices, consent records and receipts preserve the evidence, and policy-version tracking ties each decision to the notice the user saw.
Use this checklist as a starting point for your compliance program:
ConsentX provides technical tools that support privacy and consent processes. It helps put controls in place and keep evidence of them, but it does not by itself guarantee legal compliance.
Hold applicable non-essential scripts until the visitor has given consent.
Discover and categorize the cookies, scripts and trackers running on your website.
Organize data-subject requests and let people update or withdraw their preferences.
Apply a consent experience configured for visitors in Ghana alongside rules for other regions.
Rescan your website to detect new technologies and keep configuration and evidence up to date.
Present clear, purpose-based consent choices to visitors in Ghana where consent is the applicable justification.
Keep auditable consent records that capture the timestamp, consent category, purpose, policy version and user decision.
Each decision is issued as a consent receipt, so the evidence of how consent was obtained can be produced later.
Build a transparent and auditable privacy experience for users in Ghana. Scan your website, configure your Ghana privacy experience, enforce user choices, and keep evidence of cookie consent, tracking technologies, consent preferences, prior-script blocking, consent receipts, privacy requests and regional privacy rules in one place.
This page provides general information about Ghana's Data Protection Act, 2012 (Act 843) and is not legal advice. ConsentX is a technology platform that supports privacy and consent processes; it does not guarantee legal compliance. Consult qualified legal counsel about your specific obligations.
Run a ConsentX scan to find the cookies, scripts, pixels and other technologies running on your website and where they send data.
Group each technology by purpose, such as essential, analytics, functional, advertising and personalization, so each category can be governed consistently.
For each category, determine whether consent or another Section 20 justification applies, and document the decision. ConsentX applies your configuration; the legal assessment remains yours.
Set up a consent notice for visitors in Ghana that identifies your organization, explains purposes and data categories, discloses third-party sharing and leaves optional categories unselected.
Enable prior-script blocking so trackers that rely on consent do not run until the visitor has given it.
Store a consent record for each decision, including the timestamp, categories, purposes, policy version and the user's choice, and issue a consent receipt.
Give visitors a persistent way to review, change or withdraw their choices, and make sure withdrawals stop the related processing.
Route access, correction, objection and deletion requests into a tracked workflow with identity verification and record keeping.
Keep consent logs, scan reports, notice versions and request records together so you can show how choices were collected and enforced.
Track DPC guidance and the progress of the draft Data Protection Bill, 2025, and update your configuration if replacement legislation formally enters into force.
Ghana
Ghana
GDPR
UK GDPR
CCPA / CPRA
VCDPA
Colorado CPA
CTDPA
UCPA
TDPSA
Oregon OCPA
Montana MCDPA
Florida FDBR
LGPD
PIPEDA
DPDPA
PDPA
POPIA
FADP
Law 25
LFPDPPP
PDPL
Law 21.719
Law 1581
Law 29733
Law 18.331