Every business operating in Ghana that collects, stores, or processes personal data — whether from customers, employees, or any other individuals — is subject to the Data Protection Act 2012 (Act 843). This applies regardless of the size of the business, the sector in which it operates, or whether the data is processed digitally or in paper form.
Despite being over a decade old, the Data Protection Act remains poorly understood and inconsistently applied across the Ghanaian business community. The Data Protection Commission, established under the Act, has increased its enforcement activity in recent years. The time for informal compliance is over.
This guide sets out the key obligations under the Act and a practical checklist for businesses seeking to reach or maintain compliance.
Who Is Covered: Data Controllers and Data Processors
The Act applies to data controllers — any person or organisation that determines the purpose for and manner in which personal data is processed. If your business decides what customer data to collect and why, you are a data controller.
It also covers data processors — organisations that process personal data on behalf of a data controller. Cloud service providers, payroll processors, and marketing agencies that handle client data in Ghana all fall within this category.
The Act applies to data controllers and processors established in Ghana, and to those outside Ghana who process the personal data of individuals within Ghana.
Obligation 1: Register with the Data Protection Commission
Every data controller must register with the Data Protection Commission before processing any personal data. Registration requires submission of:
- Particulars of the data controller (name, address, legal form)
- Description of the personal data to be processed
- The purpose(s) for which the data will be processed
- Categories of data subjects whose data will be processed
- Recipients or categories of recipients to whom the data may be transferred
- Details of any proposed transfer of data outside Ghana
Registration is renewable annually. Operating as an unregistered data controller is a criminal offence under the Act.
Checklist item 1: Is your business registered with the Data Protection Commission? If not, registration must be completed before any personal data processing continues.
Obligation 2: Process Data Lawfully
The Act requires that all personal data be processed in accordance with one or more of the following lawful bases:
- Consent of the data subject — must be freely given, specific, and informed. Pre-ticked boxes and bundled consent do not satisfy this requirement.
- Performance of a contract — processing is necessary to fulfil a contract with the data subject
- Legal obligation — processing is required by law (e.g., employee tax records for GRA purposes)
- Legitimate interests — processing is necessary for the legitimate interests of the data controller, provided those interests are not overridden by the rights of the data subject
Checklist item 2: For each category of personal data your business processes, can you identify a lawful basis? Are those bases documented?
Obligation 3: Collect Only What You Need
The Act requires that personal data be adequate, relevant, and not excessive in relation to the purpose for which it is processed. This is the data minimisation principle.
Businesses that collect personal data "just in case" — extensive customer profiling beyond what is necessary for service delivery, for example — are in breach of this principle.
Checklist item 3: Review your data collection forms, onboarding processes, and employee records. Are you collecting only what is genuinely necessary?
Obligation 4: Keep Data Accurate and Up to Date
Data controllers must take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date. Inaccurate data that is not corrected when the inaccuracy is discovered breaches the Act.
Checklist item 4: Do you have a process for updating customer and employee records when data changes? Can data subjects request correction of inaccurate records?
Obligation 5: Honour Data Subject Rights
The Act grants individuals whose data is processed a set of enforceable rights:
- Right to access — data subjects may request a copy of all personal data held about them. You must respond within a reasonable time and may charge a reasonable fee.
- Right to correct — data subjects may require correction of inaccurate data
- Right to object — data subjects may object to processing carried out on the basis of legitimate interests or for direct marketing purposes
Checklist item 5: Does your business have a documented process for receiving and responding to data subject requests? Is there a designated person responsible for handling them?
Obligation 6: Secure Personal Data
The Act requires data controllers to take appropriate technical and organisational measures to protect personal data against accidental loss, destruction, or damage, and against unauthorised or unlawful processing.
What is "appropriate" depends on the sensitivity of the data, the size of the business, and the state of available technology. At a minimum, this means:
- Password-protected access to systems holding personal data
- Encryption of sensitive data in transit and at rest
- Staff training on data handling procedures
- A documented response plan for data breaches
Checklist item 6: When did your business last review its data security measures? Is there a breach notification procedure in place?
Penalties for Non-Compliance
The Data Protection Act imposes criminal penalties on data controllers who breach its provisions. Individuals found guilty of specified offences may face fines and imprisonment. The Data Protection Commission also has powers to issue enforcement notices requiring corrective action, and to impose administrative sanctions.
Beyond the formal penalties, a data breach or a Commission enforcement action carries significant reputational risk — particularly for businesses handling financial, health, or employment data.
Conclusion
Compliance with the Data Protection Act 843 is not optional, and the enforcement environment in Ghana is tightening. Businesses that have not completed their registration, documented their lawful processing bases, and implemented basic data security measures should treat this as an urgent priority.
Amanah provides access to the full text of the Data Protection Act and related guidance, enabling legal and compliance teams to research their obligations accurately and efficiently. Start your data protection research on Amanah — Ghana-specific legal intelligence for businesses that take compliance seriously.