Processes personal data, in Ghana

National Identity Register Regulations, 2012 (L.I. 2111), regs. 7-9 and 13-18 (mandatory use, verification and user agencies) · Read the law's page

• Demand the presentation of a national identity card from the individual concerned before you provide a service in a transaction listed in regulation 7(1), which includes opening individual or personal bank accounts, purchase of insurance policies, consumer credit transactions, registration of SIM cards and applications for public or government services, or in a transaction the Authority publishes in the Gazette under regulation 7(1)(n).
• If you are a user agency, state the purpose for which you require an individual's personal information and satisfy the Authority that the individual is aware of and has authorised the request before you access it.
• If you are a user agency that uses personal information for administrative purposes, retain it only for the period the Authority determines under its guidelines or as specified in the Data Sharing Agreement Form.
• If you are a user agency that obtains personal information, secure and store it in accordance with the Authority's guidelines or as specified in the Data Sharing Agreement.

Data Protection Act, 2012 (Act 843), s. 31 (notification of security compromises) · Read the law's page

• Notify the Data Protection Commission and the affected data subject as soon as reasonably practicable after you have reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person.
• Take steps to restore the integrity of the information system after unauthorised access or acquisition of personal data, and delay notifying the data subject only where the Commission or a security agency says notification would impede a criminal investigation.
• Give the data subject enough information in the notification to take protective measures against the consequences of the breach, including the identity of the unauthorised person if known, and communicate it by registered mail, electronic mail, the website, media publication, or another manner the Commission directs.

Data Protection Act, 2012 (Act 843), ss. 1-30, 45-74 and 82-94 · Read the law's page

• Have a lawful basis for processing personal data, and register with the Data Protection Commission before processing begins.
• Tell a data subject, before or as soon as practicable after collecting their personal data, the nature of the data, your identity, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary.
• Take appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, unauthorised destruction, and unlawful access, and require a data processor acting on your behalf to maintain the same measures under a written contract.
• When registering as a data controller, disclose the countries to which personal data may be transferred.
• Do not require a person to supply or produce a particular record, including a health record, as a condition of providing them goods, facilities, or services, unless the requirement is authorised by law or is in the public interest.

Data Protection Act, 2012 (Act 843), ss. 32-36, 39-40 and 42-44 (rights of data subjects) · Read the law's page

• Cease or refrain from processing personal data within twenty one days of a data subject's written notice that the processing causes or is likely to cause them unwarranted damage or distress, or give them your reasons for not complying.
• Do not provide, use, obtain, or procure a data subject's personal data for direct marketing without their prior written consent, and stop on their written request at any time.
• Answer a data subject's request to confirm whether you hold personal data about them, describe it, and correct it, promptly and in any event within forty days of receiving the request.
• Correct or delete personal data on a data subject's request where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell every person the data was disclosed to of the correction.
• Comply with a Commission order to rectify, block, erase, or destroy personal data found to be inaccurate on a data subject's complaint.

Data Protection Act, 2012 (Act 843), ss. 37-38 (special personal data) · Read the law's page

• Do not process special personal data, including a person's ethnicity, race, political opinion, religious belief, health, sexual life, or criminal behaviour, or the personal data of a child under parental control, unless a listed exception applies.
• Process special personal data only where it is necessary or the data subject consents, treating processing as necessary where it exercises or performs a right or obligation the law imposes on an employer.
• Where consent cannot be given or has been unreasonably withheld, process special personal data only to protect the vital interests of the data subject.
• Do not process special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.

Data Protection Act, 2012 (Act 843), ss. 43, 75-81, 88-89 and 95 (enforcement, offences and penalties) · Read the law's page

• Comply with an enforcement notice the Commission serves within the time it states and, where the notice so requires, rectify, block, erase or destroy other data you hold that contains an expression of opinion which appears to the Commission to be based on inaccurate data.
• Notify a third party to whom you disclosed personal data of its rectification, blocking, erasure or destruction where the Commission requires it, either because an enforcement notice requires you to rectify, block, erase or destroy the data or because the Commission is satisfied the data was processed in contravention of a data protection principle.
• Expect a data subject to seek compensation from you for damage or distress your contravention of the Act caused, unless you can prove you took reasonable care to comply.
• Do not purchase, knowingly obtain, or knowingly or recklessly disclose another person's personal data, and do not sell or offer to sell personal data.
• Comply with an information notice or enforcement notice the Commission issues after assessing a data subject's complaint about your processing.

Cybersecurity Act, 2020 (Act 1038), s. 59, and Second Schedule item 59(4) · Read the law's page

• This binds the public and private sectors generally in Ghana; the Act states no size or sector gate for this duty.
• Comply with the cybersecurity standards the Cyber Security Authority develops, establishes, adopts and publishes on its website, which by section 59(1) cover education and skills development, hardware and software engineering, governance and risk management, research and development, and any other area the Authority determines in line with international best practice.
• Breaching an adopted standard is an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units, payable to the Cyber Security Authority.

Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) · Read the law's page

• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.
• Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.
• Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
• This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.

Credit Reporting Act, 2007 (Act 726), ss. 2, 12, 21-22, 24-27, 30-32, 34-38, 44 and 62 · Read the law's page

• Do not establish, operate or conduct business as a credit bureau unless the Bank of Ghana has licensed you, and engage only in the activities the Act lists.
• If you are a financial institution that is a data provider, report a borrower's credit information to a licensed credit bureau only with the borrower's prior written consent, except for the cases section 25 lists, and do not induce a customer to consent.
• If you are a data provider, confirm to the credit bureau that you hold the consent of the credit information subject, and keep a record of that consent for not less than ten years.
• If you are a credit bureau, give a credit report only to a recipient registered with you that has produced confirmation of the subject's written consent, and keep a record of the requests and of the credit reports provided.
• If you are a credit bureau, keep information in your database for a maximum of six years from the occurrence of the basis for keeping it on record, and update the database on an ongoing basis.
• If you are a credit bureau, adopt security and control measures to avoid mismanagement of information, and observe the principles of confidentiality, accuracy and transparency of information, and privacy and secrecy of communication.
• If you are a credit bureau, let a person inspect the file you hold on them without charge once within twelve months, investigate a challenge to its accuracy without charge, and give the person credible evidence or remove the information if you find none.
• If you are a credit bureau, submit to the technical audits and inspections the Bank of Ghana requires.

National Identity Register Act, 2008 (Act 750), ss. 41-42, 48, 50, 53-61 and 65-73 (national identity cards, Register data and offences) · Read the law's page

• If you are a user agency, comply with the applicable provisions of Part II of Act 750 and the guidelines the Authority issues when you access, use, retain or disclose personal information from the Authority.
• Before you access an individual's personal information from the Authority's database, take reasonable steps to ensure that the individual is aware of the authority for the access, the purpose for which the information is required and the intended recipient.
• Do not use personal information obtained from the Authority for any purpose other than the one it was obtained for unless the individual authorises the use, the use is authorised or required by law, or another ground listed in section 56 applies.
• Where the Authority provides you with personal information from the Register with the individual's prior consent, do not use it for any other purpose unless the individual permits it or another ground listed in section 48(3) applies.
• Do not disclose personal information you hold to any other person unless the individual has consented, the disclosure is required or authorised by law, or another ground listed in section 57(1) applies.
• Do not disclose personal information you receive from another person for a purpose other than the purpose for which it was provided.
• Use or disclose personal information only where the use or disclosure does not invade the privacy of the individual concerned.
• Secure and store personal information you hold in accordance with the guidelines the Authority issues.
• Do not make any record of personal information received by a registration official available to an unauthorised person or a person not entitled to receive it.
• Do not use a national identity card other than the one issued for your own use, and do not permit another person to use a card issued to someone else.
• Do not take or keep possession without reasonable cause of a national identity card that is false, that you know has been improperly obtained, or that belongs to another person.
• Do not use equipment or apparatus to produce a national identity card without the approval of the Authority, or to produce a false national identity card.
• Do not cause a computer or other electronic device of the Authority to perform a function with intent to obtain access to a programme or data it holds, and do not attempt to access personal information the Authority holds contrary to the Act.
• Do not communicate to another person a number, code, password or other means to access personal information contained in a computer of the Authority, other than to a person you are duly authorised to communicate it to.