GhanaData Protection Act, rights of data subjects
Data Protection Act, 2012 (Act 843), ss. 32-36, 39-40 and 42-44 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfIn force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Consent, Disclosure
- Audit expectation
- none
What it requires
- Cease or refrain from processing personal data within twenty one days of a data subject's written notice that the processing causes or is likely to cause them unwarranted damage or distress, or give them your reasons for not complying.NIST Privacy FrameworkCT.PO-P3
- Do not provide, use, obtain, or procure a data subject's personal data for direct marketing without their prior written consent, and stop on their written request at any time.NIST Privacy FrameworkCT.PO-P1
- Answer a data subject's request to confirm whether you hold personal data about them, describe it, and correct it, promptly and in any event within forty days of receiving the request.NIST Privacy FrameworkCT.PO-P3
- Correct or delete personal data on a data subject's request where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell every person the data was disclosed to of the correction.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Comply with a Commission order to rectify, block, erase, or destroy personal data found to be inaccurate on a data subject's complaint.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The only record duty in the cited sections is the annotation of the disputed record. The access, correction, blocking and erasure rights in sections 32 to 36 and 39 to 44 otherwise state no log or retention period. The territorial rule is section 45, which this row does not cite.
- Kind
- Implicit
- As of
- Provision
- Section 33(3) (where controller and data subject cannot agree on a correction, the controller attaches to the record an indication that the request was made and not complied with)
- Trigger
- personal_data_processing
What this law does
Section 35 gives a data subject the right to be told the personal data a data controller holds about them, the purpose of processing, the recipients, and the source of the data, communicated in an intelligible form. Section 35(10) requires a data controller to comply with an access request promptly and in any event within forty days of receiving it.
Section 33 gives a data subject the right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal data corrected or deleted, and requires the data controller to tell every person the data was disclosed to of the correction. Section 39 lets an individual require a data controller to cease or not begin processing personal data that causes or is likely to cause them unwarranted damage or distress.
Section 40 bars a data controller from using a data subject's personal data for direct marketing without their prior written consent, and lets the data subject object to direct marketing at any time. Section 42 gives a data subject the right to require the rectification, blocking, erasure, or destruction of exempt manual data that is inaccurate or incomplete.
Section 44 lets the Commission order a data controller to rectify, block, erase, or destroy personal data on a data subject's complaint that it is inaccurate. Section 36 applies these rights to a credit bureau acting as a data controller, letting a data subject limit an information request to their financial standing and history for the twelve months before the request.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .