GhanaData Protection Act
Data Protection Act, 2012 (Act 843), ss. 1-30, 45-74 and 82-94
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfIn force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Licensing, Security, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Have a lawful basis for processing personal data, and register with the Data Protection Commission before processing begins.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P5
- Tell a data subject, before or as soon as practicable after collecting their personal data, the nature of the data, your identity, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary.NIST Privacy FrameworkCM.AW-P1
- Take appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, unauthorised destruction, and unlawful access, and require a data processor acting on your behalf to maintain the same measures under a written contract.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P3
- When registering as a data controller, disclose the countries to which personal data may be transferred.NIST Privacy FrameworkGV.PO-P5
- Do not require a person to supply or produce a particular record, including a health record, as a condition of providing them goods, facilities, or services, unless the requirement is authorised by law or is in the public interest.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission of Ghana (the independent statutory body that administers the Data Protection Act, 2012) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Commission's compliance page states that, in line with section 28(2) of the Act, a data protection impact assessment should be conducted before new processing that could result in high risks to individuals' privacy.
- As of
- Guidance link
- https://dpc.gov.gh/registration/
- Guidance body
- Data Protection Commission of Ghana (the independent statutory body that administers the Data Protection Act, 2012)
- Open questions
- When a data controller "is not established in this country" and its service runs only on servers abroad but is used by people in Ghana, does it count as one that "uses equipment or a data processor carrying on business in this country" under section 45(1)(b)?
- Does section 28(2)(a), which requires "reasonable measures" to "identify reasonably foreseeable internal and external risks to personal data", call for a formal data protection impact assessment before high-risk processing, as the Commission's compliance guidance states?
What it makes you log
Who may demand the log
Data subject
Logging duty
Section 24(4) keeps the record a decision rested on available to the data subject. The registration duty in sections 27 and 45 to 59 is a register the Commission keeps and the public may inspect, not a log kept by the controller. Section 28(2)(c), regularly verifying that safeguards are implemented, is a self-check of safeguards and names no record or audit of one. The period is the one a law or code of conduct sets, else long enough for the data subject to request access; the general limit in section 24(1) concerns the personal data and is not a log period. Section 45(1)(b), which reaches a controller using equipment or a processor in Ghana, turns on where the means are located and states no hook value; section 45(1)(c), information originating from Ghana, is likewise left out.
- Kind
- Implicit
- As of
- Provision
- Section 24(4) (a person who uses a record of a data subject's personal data to make a decision about the data subject must retain that record for the period the law or a code of conduct sets, or otherwise long enough for the data subject to request access)
- Trigger
- personal_data_processing
What this law does
The Data Protection Act, 2012 (Act 843) is administered by the Data Protection Commission, an independent statutory body it establishes. A data controller or processor established in Ghana, or using equipment or a processor in Ghana, must have a lawful basis before processing personal data, and section 27 requires it to register with the Commission before processing begins.
Section 27(2) requires a data controller collecting personal data to tell the data subject the nature of the data, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary. Sections 28 to 30 require appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, or unlawful access, and require a data processor acting for a data controller to maintain the same measures under a written contract.
Sections 45 to 59 establish the Data Protection Register and govern an application for registration, its refusal, grant, renewal, removal, and cancellation, and section 47(1)(g) requires an applicant to disclose the countries to which it may transfer the data it holds. Sections 60 to 74 exempt processing carried out for national security, crime and taxation, health, education and social work, regulatory activity, journalism, and research, among other listed purposes.
Section 82 bars a person providing goods, facilities, or services to the public from requiring a person to supply a particular record as a condition of that provision, and section 83 bars demanding a record of a person's physical or mental health or condition. The Act binds the Republic itself, treating each government department as a data controller. The Act was gazetted on . Its commencement was left to a date the Minister specifies by notice in the Gazette. The Data Protection Commission gives as the day the Act came into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .