Ghana
ModerateData Protection Act 2012 (Act 843)
Authority: Data Protection Commission | Enforcement: Active | Enacted: October 2012
Overview
Ghana enacted the Data Protection Act in 2012, establishing the Data Protection Commission. The law covers consent, data subject rights, and registration of data controllers. The Commission actively registers data controllers and issues guidance.
14-Topic Coverage
Data Protection Authority
Fully AddressedData Protection Commission oversees registration, complaints, and enforcement.
Consent Requirements
Fully AddressedConsent required for processing. Must be express for sensitive data.
Data Subject Rights
Fully AddressedRights to access, correction, and deletion.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with appropriate safeguards.
Breach Notification
Partially AddressedNo explicit statutory requirement. Commission guidance recommends notification.
DPO Requirements
Partially AddressedData controllers must register with the Commission. No formal DPO role.
Children's Data
Partially AddressedGeneral provisions apply. Children's Act provides some protections.
Penalties & Enforcement
Fully AddressedFines up to GHS 24,000 and/or imprisonment up to 4 years.
Sector-Specific Rules
Partially AddressedBOG financial data rules, NCA telecom regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions on automated decisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedAct applies to government processing with national security exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Ghana's regulations.
Book a Consultation