Processing of personal data in Ghana; accountability, lawfulness and transparency principles.
Key obligations
Mandatory registration and renewal of data controllers with the DPC; Processing principles; special-category safeguards; Security and confidentiality duties
DPO required
Data protection supervisor expected for registered controllers.
Registration
Yes: DPC register; enforcement of registration intensified 2025 (deadline 31 Dec 2025, fines-backed enforcement announced from Jan 2026).
Cross-border transfers
Accountability principle applies to foreign transfers.
Breach notification
Section 31 ('Notification of security compromises'): where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person, the controller (or a processor acting under its authority) must notify the Commission and the data subject as soon as reasonably practicable after discovery; notification to the subject may be delayed if security agencies or the Commission advise it would impede a criminal investigation. No fixed hour/day clock.
Penalties
Fines (penalty units) and imprisonment for offences, incl. unregistered processing.
Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.