Ghana Data Protection Act Compliance

What is Ghana's Data Protection Act?

The Data Protection Act, 2012 (Act 843) establishes the legal framework for protecting personal data in Ghana. It regulates the collection, use, disclosure, storage, security and destruction of personal data, and it addresses:

• Lawful processing
• Data minimization
• Purpose limitation
• Transparency
• Data quality
• Security
• Data-subject participation
• Registration
• Data processing oversight
• International processing
• Special personal data
• Regulatory enforcement

The Data Protection Commission is the regulator established by the Act. It maintains the register of data controllers, monitors compliance, investigates complaints, takes enforcement action and promotes awareness of data protection in Ghana.

Consent is important, but Ghana's DPA is not a consent-only law. Section 20 provides for consent and for specified alternative justifications, so each processing activity should rest on the justification that actually fits it.

Data controllers and data processors

A data controller determines the purposes for which, and the manner in which, personal data is processed. Controllers carry primary responsibility for compliance, including registration with the DPC. Examples include:

• E-commerce companies
• Banks and financial institutions
• Insurance companies
• Employers
• Healthcare providers
• Universities and schools
• Telecommunications businesses
• SaaS companies
• Marketing companies
• Government institutions
• Online platforms

A data processor handles personal data on behalf of a controller, following the controller's instructions. Examples include:

• Cloud providers
• Payroll providers
• CRM platforms
• Hosting providers
• Analytics providers
• Marketing platforms
• Customer-support providers

Territorial scope

Act 843 applies to data controllers established in Ghana that process personal data in Ghana. It can also apply to controllers not established in Ghana that use equipment, or a data processor carrying on business, in Ghana to process personal data, other than for the purpose of transit through Ghana.

Section 18 also addresses foreign data subjects. Where personal data originating from a foreign jurisdiction is sent into Ghana for processing, the data controller must ensure that the data is processed according to the data protection legislation of that foreign jurisdiction.

International organizations should therefore assess Ghanaian requirements alongside the other privacy laws that apply to their data subjects, systems and service providers.

What is personal data under Act 843?

Under Act 843, personal data is data about an individual who can be identified from that data, or from that data together with other information that the data controller holds or is likely to obtain. Examples include:

• Names
• Email addresses
• Telephone numbers
• Identification numbers
• Account information
• Employment information
• Location information
• Online identifiers
• Financial information
• Health information
• Biometric or genetic information

Whether a technical identifier, such as a cookie ID or device identifier, is personal data depends on whether it can be linked to an identifiable individual in context.

Lawful bases for processing

Section 20 provides that personal data should not be processed without the prior consent of the data subject unless another specified justification applies. Consent is not the only justification. Processing may also rely on:

• Contractual necessity - processing necessary for a contract to which the data subject is a party
• Authorization or requirement by law - processing authorized or required by law
• Protection of the data subject's legitimate interest - processing to protect a legitimate interest of the data subject
• Performance of a statutory duty - processing necessary for the proper performance of a statutory duty
• Legitimate interests - processing necessary to pursue the legitimate interest of the data controller or of a third party to whom the data is supplied

Organizations should document the justification relied on for every processing activity. A documented justification shows why the processing is permitted, determines whether consent must be collected and recorded, and shapes how objections and rights requests are handled.

Consent management

Where consent is the applicable justification, it should be:

• Informed - based on clear information about what the person is agreeing to
• Voluntary - freely given
• Free from coercion - not obtained through pressure or penalty
• Specific - linked to defined purposes
• Understandable - explained in plain language
• Clearly recorded - captured at the time it is given
• Demonstrable - supported by evidence that can be produced later

A digital consent interface should communicate:

• The identity of the organization
• The purpose of collection
• The categories of personal data involved
• Any sharing with third parties
• Marketing and tracking purposes
• How users can manage their preferences

Consent withdrawal and objections

Act 843 gives data subjects the right to object to the processing of their personal data where applicable, and processing should stop where an objection is valid. Where consent is the basis for processing, people should also be able to withdraw it.

These rights only work if operational workflows support them. Organizations should maintain:

• Consent records
• Records of objections
• Withdrawal mechanisms where consent is the basis
• Preference updates
• Direct-marketing suppression
• Propagation of preference changes across every system that uses the data

Special personal data

Act 843 gives enhanced protection to special personal data, which includes information about:

• Race
• Colour
• Ethnic or tribal origin
• Political opinions
• Religious or similar beliefs
• Physical health
• Medical information
• Mental health or mental condition
• DNA
• Sexual orientation
• Commission or alleged commission of an offence
• Proceedings relating to an offence
• Criminal proceedings or sentencing information

Before processing special personal data, organizations should assess:

• The legal justification
• Consent requirements
• Security
• Access restrictions
• Retention
• Data sharing
• International transfers
• DPIA requirements
• The potential impact on individuals

Privacy notices and transparency

Openness is one of the Act's principles. A privacy notice should explain:

• The identity of the controller
• Contact information
• The purpose of collection
• The categories of personal data collected
• How the information will be used
• Recipients of the data
• Data-subject rights
• Direct marketing
• International transfers
• Retention
• Complaint mechanisms, including the right to complain to the DPC

Data-subject rights

Act 843 gives individuals rights over their personal data. Each right applies where applicable and subject to statutory conditions.

• Right to be informed - individuals should be told about the collection of their personal data, the purpose of collection and other matters that make processing transparent.
• Right of access - individuals may ask a data controller to confirm whether it holds their personal data and to provide a description of that data, subject to identity verification and the conditions in the Act.
• Right to correction - individuals may request correction of personal data that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading.
• Right to blocking, erasure or destruction - where applicable, individuals may seek the blocking, erasure or destruction of personal data, including data the controller is no longer authorized to retain or data that is inaccurate.
• Right to object - individuals may object to the processing of their personal data, and to processing likely to cause them unwarranted damage or distress, subject to statutory conditions.
• Right relating to direct marketing - individuals may require a data controller to stop, or not to begin, processing their personal data for direct marketing.
• Right to compensation - an individual who suffers damage or distress because of a contravention of the Act may be entitled to compensation, subject to statutory conditions.

Data subject access requests

A practical workflow for handling access and other rights requests:

• Request intake - receive requests through defined channels and log each one.
• Identity verification - confirm the requester is the data subject or an authorized representative.
• Request classification - determine which right is being exercised.
• Data discovery - locate the relevant personal data across systems and vendors.
• Review of exemptions and third-party information - check statutory exemptions and protect other people's data.
• Response preparation - prepare a clear, accurate response.
• Secure delivery - deliver the response through a secure channel.
• Record keeping - keep a record of the request, decision and response.

ConsentX can support privacy request workflows by organizing intake, tracking status and keeping records. The software does not determine legal outcomes; decisions about exemptions and responses remain with the organization.

Direct marketing

Act 843 lets individuals require a data controller to stop, or not to begin, processing their personal data for direct marketing. This affects:

• Email marketing
• SMS marketing
• Advertising
• Other marketing channels
• Marketing preferences
• Consent and opt-out records
• Direct-marketing suppression

ConsentX preference management helps organizations capture marketing choices, keep records of consents and opt-outs, and pass updated preferences to connected systems so suppressed contacts are not targeted.

Automated decision-making

Automated processing, including profiling, raises specific privacy considerations:

• Transparency
• Purpose
• Data quality
• Fairness
• Security
• Human involvement where appropriate
• Potential impact on individuals
• High-risk processing

Profiling and automated decision-making may warrant a DPIA, depending on the processing and the applicable requirements.

Data protection impact assessments

A Data Protection Impact Assessment (DPIA) is a proactive privacy-risk assessment. It identifies how a processing activity could affect individuals and which measures reduce those risks before processing begins.

A DPIA may be relevant for:

• New processing activities
• New technologies
• Significant changes to existing processing
• Special personal data
• Profiling
• Automated decision-making
• Processing that presents significant risks to individuals

Data Protection Supervisor

Section 58 provides for a data controller to appoint a certified and qualified person as a Data Protection Supervisor to monitor the controller's compliance with the Act.

An effective Data Protection Supervisor should have:

• Certification and qualification for the role
• Responsibility for compliance monitoring
• Appropriate training
• Sufficient authority within the organization
• The knowledge and resources needed to carry out the role

Data security

Controllers should take appropriate, reasonable technical and organizational measures to protect personal data against:

• Unauthorized access
• Unauthorized disclosure
• Accidental loss
• Destruction
• Alteration
• Improper use
• Unlawful processing

Practical measures include:

• Encryption
• Access controls
• Authentication
• Multi-factor authentication
• Network security
• Secure backups
• Logging and monitoring
• Data-loss prevention
• Employee training
• Vendor controls
• Incident response

Data breach management

A practical breach-response process:

• Incident detection
• Containment
• Risk assessment
• Identifying affected data
• Assessing affected individuals
• Regulatory notification where required
• Individual notification where required
• Remediation
• Documentation
• Post-incident review

Act 843 does not set a universal 72-hour breach-notification deadline. Organizations should assess notification to the DPC and to affected individuals where required under the current Act.

Any breach-notification timelines in the draft Data Protection Bill, 2025 are proposals only. They should not be treated as current obligations unless and until replacement legislation formally enters into force.

Registration with the DPC

Data controllers are generally required to register with the Data Protection Commission before processing personal data. A registration application may include:

• Business name and address
• Representative information
• A description of the personal data processed
• Categories of individuals
• Special personal data
• Processing purposes
• Intended recipients
• Countries to which data may be transferred
• Categories of persons whose data is held
• A general description of security measures

Under Act 843, processing personal data without registering as a data controller is an offence, punishable on summary conviction by a fine, imprisonment or both, as specified in the Act. Organizations should confirm the applicable penalty with their legal advisers.

Assessable processing

Act 843 includes an assessable-processing framework. Processing that may cause substantial damage or substantial distress to a data subject, or significantly prejudice the privacy rights of a data subject, may be subject to additional review by the DPC.

Organizations planning high-risk processing should consider whether this framework applies before the processing begins.

International data transfers

Before transferring personal data outside Ghana, organizations should assess the applicable requirements, including:

• Destination countries
• Overseas recipients
• Data categories
• Transfer purposes
• Security safeguards
• Contractual protections
• Applicable foreign privacy laws

DPC registration information includes the countries to which a data controller intends to transfer personal data, so transfer arrangements and registration details should stay aligned.

Data retention and deletion

Retention should be connected to the purpose for which personal data was collected and to any applicable legal requirements. A retention program should cover:

• Retention periods
• Deletion procedures
• Archiving
• Legal holds
• Automated deletion where appropriate
• Secure destruction
• Periodic retention reviews

Data processors and vendors

Controllers remain responsible for personal data processed by third parties on their behalf. Vendor agreements should address:

• Processing instructions
• Purpose limitation
• Confidentiality
• Security
• Sub-processors
• Retention
• Deletion
• Incident management
• Data-subject requests
• International transfers
• Compliance assistance

Privacy by design

Privacy is easier to achieve when it is built into products and processes from the beginning. Useful practices include:

• Data minimization
• Purpose limitation
• Privacy-friendly defaults
• Access controls
• Encryption
• Retention limits
• Consent controls
• Audit logs
• Secure deletion

Cookies and online tracking

Act 843 regulates the processing of personal data. It does not create a universal, one-size-fits-all cookie rule. Websites and apps commonly use:

• Essential cookies
• Analytics cookies
• Advertising cookies
• Social-media pixels
• Retargeting technologies
• Personalization
• Device identifiers
• Third-party scripts

Organizations should determine whether each tracking technology processes personal data and, where it does, identify the appropriate legal justification under the Act.

Cookie consent and prior-script blocking

Where consent is the applicable legal basis for tracking, the following controls help make that consent meaningful:

• Clear consent notices
• Purpose-based choices
• Optional categories that are not preselected
• Prior blocking of applicable trackers
• Consent withdrawal
• Preference management
• Consent records
• Policy-version tracking

ConsentX supports technical enforcement of these choices. Prior-script blocking stops applicable trackers from running until the visitor has given consent, and preference management lets visitors change their choices at any time.

Compliance monitoring and audits

Organizations should be able to produce evidence of compliance, including:

• DPC registration
• Privacy notices
• Consent records
• Data maps
• Processing inventories
• DPIAs
• Security assessments
• Vendor agreements
• Breach records
• Data-subject requests
• Marketing preferences
• Retention schedules
• Training records
• Data Protection Supervisor records

DPC enforcement

Ghana's Data Protection Commission is responsible for:

• Regulatory oversight
• Controller registration
• Investigations
• Complaints
• Compliance monitoring
• Enforcement
• Guidance
• Training
• Awareness

The Commission can investigate complaints, carry out inspections and issue notices requiring organizations to take steps to comply with the Act.

Offences and penalties under Act 843

Act 843 contains specific offences with their own penalties. No single maximum applies to every offence. The Act distinguishes between:

• Failure to register - processing personal data without registering as a data controller carries its own penalty under the Act
• Failure to comply with certain notices - non-compliance with specified notices issued by the Commission carries its own penalty
• Other statutory offences - other offences set out in the Act carry the penalties specified for them
• General penalty under Section 95 - where no specific penalty is provided, a person who commits an offence is liable on summary conviction to a fine of not more than five thousand penalty units, imprisonment of not more than ten years, or both

Organizations should check the penalty attached to each specific provision rather than assuming the Section 95 maximum applies.

Ghana Data Protection Bill 2025

The Data Protection Bill, 2025 is a draft replacement proposal for Act 843.

• The Bill is a draft proposal and must not be treated as current operative law.
• Act 843 remains the current data protection framework in Ghana.
• Organizations should monitor legislative developments.
• Compliance reviews should be updated if replacement legislation formally enters into force.

Why consent management matters for Ghana

Consent management is one component of Ghana's broader privacy framework, alongside registration, security, data-subject rights and governance. Where consent is relied on, organizations should be able to demonstrate:

• What the user was told
• The purpose the user agreed to
• When consent was given
• Which categories were selected
• Which privacy notice was presented
• Whether consent was later withdrawn
• How preferences were enforced

ConsentX connects these questions to technical controls: prior-script blocking enforces choices, consent records and receipts preserve the evidence, and policy-version tracking ties each decision to the notice the user saw.

Ghana DPA compliance checklist

Use this checklist as a starting point for your compliance program:

• Determine whether Act 843 applies
• Identify controller and processor roles
• Map personal-data processing
• Identify lawful justifications
• Review consent mechanisms
• Provide privacy notices
• Identify special personal data
• Assess children's-data processing
• Register as a data controller where required
• Review Data Protection Supervisor requirements
• Implement security safeguards
• Establish incident response
• Review DPIA requirements
• Assess international transfers
• Establish retention and deletion rules
• Implement data-subject request procedures
• Maintain direct-marketing preferences
• Review automated decision-making
• Maintain vendor agreements
• Maintain compliance evidence
• Monitor the 2025 draft Bill