Regulations › Rest of world › Ghana
DPA (Ghana)
Data Protection Act, 2012 (Act 843, Ghana)
WhenIn effect since 16 October 2012
Who enforces itData Protection Commission (DPC)
Who it applies toData controllers established in Ghana or processing data there.
Tell the regulatorNotify the Commission as soon as reasonably practicable after discovery
DPO requiredStatute lets controllers appoint a certified data protection supervisor
RegistrationEvery data controller must register with the Commission, pay a fee and renew every two years
Transfers abroadNo general transfer restriction
Request deadline40 days for access requests
Maximum fineGeneral penalty up to 5,000 penalty units (about GHS 60,000) and/or 10 years' imprisonment
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies to controllers in Ghana, foreign controllers using equipment or processors in Ghana, and processing of information originating in Ghana.s.45(1) · source ↗
s.45(1)(c) on data originating in Ghana is broad; interpretation not tested.
Lawful basis
1
Prior consent or listed grounds, including contract, legal obligation, and legitimate interests of the controller or a third party.s.20(1) · source ↗
Consent
1
Consent is not defined; prior consent is the default and written consent is required for direct marketing.s.20(1); s.40(1); s.94(1)(b) · source ↗
Sensitive data
2
Special personal data (health, religion, ethnicity, sexual life and others) is prohibited unless consent or a listed exception applies.s.37 · source ↗
Children
3
Age 18 (Children's Act). Data about a child under parental control is treated as special personal data.s.37(1)(a) · source ↗
Act 843 does not define child; 18 from the Children's Act 1998 (Act 560), not re-read.
People's rights
Rights
2
Access, correction and deletion, the right to prevent processing, direct marketing opt-out, and rights against solely automated decisions.ss.33, 35, 39-41 · source ↗
No portability or restriction right.
Request deadline
1
40 days for access requests; 21 days to respond to notices to prevent processing.s.35(10); s.39(2) · source ↗
Marketing
3
Direct marketing requires the data subject's prior written consent, and data subjects may later require it to stop.s.40(1)-(2) · source ↗
Governance
DPO required
2
Statute lets controllers appoint a certified data protection supervisor; DPC guidance requires medium and large controllers to appoint one.s.58(1); DPC Guidelines to Demonstrate Compliance · source ↗
Legal force of the guideline over the statutory 'may' is unclear; size thresholds not published.
DPO qualifications
3
Supervisors must meet Commission criteria; the DPC certifies them after a course at an accredited institution and a DPC examination.s.58(6)-(7); CDPS Guidelines · source ↗
Registration
3
Every data controller must register with the Commission, pay a fee and renew every two years; processing unregistered is an offense.ss.27, 46-50, 53, 56 · source ↗
Fee amounts not seen.
DPIA
1
No general DPIA duty; the Minister may designate assessable processing needing prior Commission review, and DPC guidance lists DPIAs as good practice.s.57; DPC Guidelines s.3 · source ↗
No executive instrument on assessable processing located.
Records
2
No standalone record of processing duty; registration files the data held, purposes, recipients and transfer countries. DPC guidance recommends a RoPA.s.47; DPC Guidelines s.3 · source ↗
Level reflects particulars filed at registration.
Retention
2
Data may not be kept longer than necessary and must then be destroyed, deleted or de-identified.s.24(1), (5) · source ↗
Breaches
Tell the regulator
1
Notify the Commission as soon as reasonably practicable after discovery; no fixed hour limit.s.31(1)-(2) · source ↗
Tell people
3
Notify affected data subjects in every case, as soon as reasonably practicable, unless delay is needed for a criminal investigation.s.31(1), (4) · source ↗
Transfers
Transfers abroad
1
No general transfer restriction; controllers must ensure foreign processors comply and list transfer countries at registration.ss.18(2), 30(4), 47(1)(g) · source ↗
Enforcement
Maximum fine
1
General penalty up to 5,000 penalty units (about GHS 60,000) and/or 10 years' imprisonment.s.95 · source ↗
Cedi value assumes GHS 12 per penalty unit under the Fines (Penalty Units) Act; not verified.
Criminal liability
2
Offenses include processing without registration (2 years) and selling personal data (5 years); general penalty up to 10 years.ss.56, 89, 95 · source ↗
No general officer-liability clause except for credit bureaus (s.90(1)(c)).
Private action
2
Individuals who suffer damage or distress from a contravention are entitled to compensation, subject to a reasonable care defense.s.43 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws