GhanaData Protection Act, notification of security compromises
Data Protection Act, 2012 (Act 843), s. 31 (notification of security compromises)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfIn force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify the Data Protection Commission and the affected data subject as soon as reasonably practicable after you have reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person.NIST Privacy FrameworkCM.AW-P7
- Take steps to restore the integrity of the information system after unauthorised access or acquisition of personal data, and delay notifying the data subject only where the Commission or a security agency says notification would impede a criminal investigation.NIST Privacy FrameworkPR.PO-P7
- Give the data subject enough information in the notification to take protective measures against the consequences of the breach, including the identity of the unauthorised person if known, and communicate it by registered mail, electronic mail, the website, media publication, or another manner the Commission directs.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 31 requires notice of unauthorised access or acquisition to the Commission and the data subject as soon as reasonably practicable, and the content of the notice to the data subject. It does not require the controller to document or keep a register of breaches, so it is a notification duty only.
- Kind
- None
- As of
What this law does
Section 31(1) requires a data controller, or a third party processing data under its authority, to notify the Data Protection Commission and the affected data subject where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person. Section 31(2) requires that notification to be made as soon as reasonably practicable after discovery of the unauthorised access or acquisition.
Section 31(3) requires the data controller to take steps to restore the integrity of the information system. Section 31(4) lets the data controller delay notifying the data subject where a security agency or the Commission says notification would impede a criminal investigation.
Section 31(5) lets the notification to a data subject be made by registered mail, electronic mail, prominent placement on the responsible party's website, publication in the media, or another manner the Commission directs. Section 31(6) and (7) require the notification to give the data subject enough information to take protective measures, including the identity of the unauthorised person if it is known to the data controller.
Section 31(8) lets the Commission direct the data controller to publicise the compromise where publicity would protect an affected data subject.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .