Ghana

Data Protection Act, 2012 (Act 843) IN FORCE

commenced 2012-10-16 (assent); operational from 2014 · Official full text ↗

Scope

Processing of personal data in Ghana; accountability, lawfulness and transparency principles.

Key obligations

Mandatory registration and renewal of data controllers with the DPC; Processing principles; special-category safeguards; Security and confidentiality duties

DPO required

Data protection supervisor expected for registered controllers.

Registration

Yes: DPC register; enforcement of registration intensified 2025 (deadline 31 Dec 2025, fines-backed enforcement announced from Jan 2026).

Cross-border transfers

Accountability principle applies to foreign transfers.

Breach notification

Section 31 ('Notification of security compromises'): where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person, the controller (or a processor acting under its authority) must notify the Commission and the data subject as soon as reasonably practicable after discovery; notification to the subject may be delayed if security agencies or the Commission advise it would impede a criminal investigation. No fixed hour/day clock.

Penalties

Fines (penalty units) and imprisonment for offences, incl. unregistered processing.

Authority

Data Protection Commission (DPC)

Verified 2026-07-10

Right to Information Act 2019 (Act 989) IN FORCE