GhanaData Protection Act, enforcement, offences and penalties
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfIn force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Data Protection Commission
- Obligation class
- Governance, Prohibition, Reporting
- Audit expectation
- on_request
What it requires
- Comply with an enforcement notice the Commission serves within the time it states and, where the notice so requires, rectify, block, erase or destroy other data you hold that contains an expression of opinion which appears to the Commission to be based on inaccurate data.NIST Privacy FrameworkGV.PO-P5
- Notify a third party to whom you disclosed personal data of its rectification, blocking, erasure or destruction where the Commission requires it, either because an enforcement notice requires you to rectify, block, erase or destroy the data or because the Commission is satisfied the data was processed in contravention of a data protection principle.NIST Privacy FrameworkCM.AW-P5
- Expect a data subject to seek compensation from you for damage or distress your contravention of the Act caused, unless you can prove you took reasonable care to comply.
- Do not purchase, knowingly obtain, or knowingly or recklessly disclose another person's personal data, and do not sell or offer to sell personal data.NIST Privacy FrameworkCT.PO-P1
- Comply with an information notice or enforcement notice the Commission issues after assessing a data subject's complaint about your processing.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Where a person commits an offence under the Act for which no penalty is specified, the general penalty is a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both (s. 95). Selling or offering to sell personal data, or knowingly or recklessly disclosing confidential Commission information about an identifiable individual, each carry a fine of not more than two thousand five hundred penalty units or imprisonment of not more than five years, or both (ss. 89, 85(3)). Purchasing, obtaining, or unlawfully disclosing personal data, requiring a person to produce a record as a condition of a service, failing to register as a data controller, or continuing assessable processing without the Commission's clearance, each carry a fine of not more than two hundred and fifty penalty units or imprisonment of not more than two years, or both (ss. 88, 82(3), 56, 57(6)). Failing to comply with an enforcement notice or an information notice, or making a false statement in response to one, carries a fine of not more than one hundred and fifty penalty units or imprisonment of not more than one year, or both (s. 80). An offence under Regulations made under the Act carries a fine of not more than five thousand penalty units (s. 94(2)).
Penalty structure
Section 95 (General penalty) sets the residual ceiling for any offence under the Act with no penalty otherwise specified: a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both. Named offences carry lower fixed tiers, for example two thousand five hundred penalty units for prohibited sale of personal data (s. 89) or unlawful disclosure of confidential Commission information (s. 85(3)), and two hundred fifty penalty units for prohibited purchase, obtaining, or disclosure of personal data (s. 88), for demanding a record as a condition of service (s. 82(3)), or for failure to register as a data controller (s. 56). The Act states the section 95 ceiling as five thousand penalty units; the value of a unit is fixed by a schedule to the Fines (Penalty Units) Act, 2000 (Act 572) that the Attorney-General may amend by legislative instrument, and the Judicial Service of Ghana's criminal bench book states that a penalty unit is twelve Ghana cedis (GH¢12), which makes the ceiling sixty thousand Ghana cedis.
- Rule
- Fixed only
- As of
- Currency
- GHS
- Fixed cap
- 60,000
What it makes you log
Logging duty
Sections 75 to 81 let the Commission serve enforcement and information notices and let an authorised officer enter and inspect premises to ensure compliance. No record is named that a controller must keep, and the offence and penalty sections (80, 88, 89, 95) and compensation section 43 add none.
- Kind
- None
- As of
What this law does
Section 75 lets the Commission serve a data controller who has contravened or is contravening a data protection principle with an enforcement notice requiring it to take or refrain from taking specified steps within a stated time, or to stop processing specified personal data. Section 76 lets the Commission cancel or vary an enforcement notice on its own motion or on the application of the person it was served on.
Section 77 lets a person affected by processing request the Commission to assess whether it complies with the Act, and section 78 lets the Commission make a formal determination that processing is inconsistent with the Act. Section 80 makes it an offence, carrying a fine of not more than one hundred and fifty penalty units or imprisonment of not more than one year or both, to fail to comply with an enforcement notice or an information notice, or to make a false statement in response to one.
Section 43 entitles an individual who suffers damage or distress through a data controller's contravention of the Act to compensation from that data controller, subject to the defence that the data controller took reasonable care to comply. Section 88 bars a person from purchasing, knowingly obtaining, or knowingly or recklessly disclosing another person's personal data, and section 89 bars selling or offering to sell personal data.
Section 95 sets the residual penalty for an offence under the Act with no penalty otherwise specified at a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both. The Judicial Service of Ghana's criminal bench book states that a penalty unit is twelve Ghana cedis (GH¢12), which puts the most that section 95 allows at sixty thousand Ghana cedis.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .