Regulations › Rest of world › Ghana
DPA (Ghana)
Data Protection Act, 2012 (Act 843, Ghana)
WhenIn effect since 16 October 2012
Who enforces itData Protection Commission (DPC)
Who it applies toData controllers established in Ghana or processing data there.
Tell the regulatorNotify the Commission as soon as reasonably practicable after discovery
DPO requiredStatute lets controllers appoint a certified data protection supervisor
RegistrationEvery data controller must register with the Commission, pay a fee and renew every two years
Transfers abroadNo general transfer restriction
Request deadline40 days for access requests
Maximum fineGeneral penalty up to 5,000 penalty units (about GHS 60,000) and/or 10 years' imprisonment
57%
of Ghana's 21 requirements are already met by European Union (GDPR). Here is what DPA (Ghana) adds, biggest gaps first.
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
DPA (Ghana) adds3 Every data controller must register with the Commission, pay a fee and renew every two years; processing unregistered is an offense.
ss.27, 46-50, 53, 56 · source ↗
DPO qualificationsGovernanceBig gap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
DPA (Ghana) adds3 Supervisors must meet Commission criteria; the DPC certifies them after a course at an accredited institution and a DPC examination.
s.58(6)-(7); CDPS Guidelines · source ↗
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
DPA (Ghana) adds3 Applies to controllers in Ghana, foreign controllers using equipment or processors in Ghana, and processing of information originating in Ghana.
s.45(1) · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
DPA (Ghana) adds3 Age 18 (Children's Act). Data about a child under parental control is treated as special personal data.
s.37(1)(a) · source ↗
MarketingPeople's rightsGap
GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
DPA (Ghana) adds3 Direct marketing requires the data subject's prior written consent, and data subjects may later require it to stop.
s.40(1)-(2) · source ↗
DPO requiredGovernanceGap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
DPA (Ghana) adds2 Statute lets controllers appoint a certified data protection supervisor; DPC guidance requires medium and large controllers to appoint one.
s.58(1); DPC Guidelines to Demonstrate Compliance · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
DPA (Ghana) adds2 Data may not be kept longer than necessary and must then be destroyed, deleted or de-identified.
s.24(1), (5) · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
DPA (Ghana) adds3 Notify affected data subjects in every case, as soon as reasonably practicable, unless delay is needed for a criminal investigation.
s.31(1), (4) · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
DPA (Ghana) adds2 Offenses include processing without registration (2 years) and selling personal data (5 years); general penalty up to 10 years.
ss.56, 89, 95 · source ↗
Already covered by GDPR: Lawful basis, Consent, Sensitive data, Rights, Request deadline, DPIA, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means DPA (Ghana) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws