Data Protection Act

The Data Protection Act, 2012 (Act 843) is administered by the Data Protection Commission, an independent statutory body it establishes. A data controller or processor established in Ghana, or using equipment or a processor in Ghana, must have a lawful basis before processing personal data, and section 27 requires it to register with the Commission before processing begins.

Section 27(2) requires a data controller collecting personal data to tell the data subject the nature of the data, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary. Sections 28 to 30 require appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, or unlawful access, and require a data processor acting for a data controller to maintain the same measures under a written contract.

Sections 45 to 59 establish the Data Protection Register and govern an application for registration, its refusal, grant, renewal, removal, and cancellation, and section 47(1)(g) requires an applicant to disclose the countries to which it may transfer the data it holds. Sections 60 to 74 exempt processing carried out for national security, crime and taxation, health, education and social work, regulatory activity, journalism, and research, among other listed purposes.

Section 82 bars a person providing goods, facilities, or services to the public from requiring a person to supply a particular record as a condition of that provision, and section 83 bars demanding a record of a person's physical or mental health or condition. The Act binds the Republic itself, treating each government department as a data controller. The Act was gazetted on 18 May 2012. Its commencement was left to a date the Minister specifies by notice in the Gazette. The Act came into force in October 2012.