Ghana

Section 31(1) requires a data controller, or a third party processing data under its authority, to notify the Data Protection Commission and the affected data subject where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person. Section 31(2) requires that notification to be made as soon as reasonably practicable after discovery of the unauthorised access or acquisition.

Section 31(3) requires the data controller to take steps to restore the integrity of the information system. Section 31(4) lets the data controller delay notifying the data subject where a security agency or the Commission says notification would impede a criminal investigation.

Section 31(5) lets the notification to a data subject be made by registered mail, electronic mail, prominent placement on the responsible party's website, publication in the media, or another manner the Commission directs. Section 31(6) and (7) require the notification to give the data subject enough information to take protective measures, including the identity of the unauthorised person if it is known to the data controller.

Section 31(8) lets the Commission direct the data controller to publicise the compromise where publicity would protect an affected data subject.

The Data Protection Act, 2012 (Act 843) is administered by the Data Protection Commission, an independent statutory body it establishes. A data controller or processor established in Ghana, or using equipment or a processor in Ghana, must have a lawful basis before processing personal data, and section 27 requires it to register with the Commission before processing begins.

Section 27(2) requires a data controller collecting personal data to tell the data subject the nature of the data, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary. Sections 28 to 30 require appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, or unlawful access, and require a data processor acting for a data controller to maintain the same measures under a written contract.

Sections 45 to 59 establish the Data Protection Register and govern an application for registration, its refusal, grant, renewal, removal, and cancellation, and section 47(1)(g) requires an applicant to disclose the countries to which it may transfer the data it holds. Sections 60 to 74 exempt processing carried out for national security, crime and taxation, health, education and social work, regulatory activity, journalism, and research, among other listed purposes.

Section 82 bars a person providing goods, facilities, or services to the public from requiring a person to supply a particular record as a condition of that provision, and section 83 bars demanding a record of a person's physical or mental health or condition. The Act binds the Republic itself, treating each government department as a data controller. The Act was gazetted on 18 May 2012. Its commencement was left to a date the Minister specifies by notice in the Gazette. The Data Protection Commission gives 16 October 2012 as the day the Act came into force.

Section 41 entitles an individual, by written notice to a data controller, to require that any decision significantly affecting them is not based solely on the automatic processing of their personal data.

Even without a prior notice, if a controller does base such a significant decision solely on automated processing, it must notify the individual as soon as reasonably practicable, and the individual may then require the controller to reconsider the decision within twenty-one days of that notification. The controller must then answer in writing, within twenty-one days after receiving the individual's notice, what steps it intends to take to comply.

The right does not apply to a decision made in the course of considering or performing a contract with the data subject, one authorized or required by an enactment, or other circumstances the Minister prescribes.

Section 35 gives a data subject the right to be told the personal data a data controller holds about them, the purpose of processing, the recipients, and the source of the data, communicated in an intelligible form. Section 35(10) requires a data controller to comply with an access request promptly and in any event within forty days of receiving it.

Section 33 gives a data subject the right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal data corrected or deleted, and requires the data controller to tell every person the data was disclosed to of the correction. Section 39 lets an individual require a data controller to cease or not begin processing personal data that causes or is likely to cause them unwarranted damage or distress.

Section 40 bars a data controller from using a data subject's personal data for direct marketing without their prior written consent, and lets the data subject object to direct marketing at any time. Section 42 gives a data subject the right to require the rectification, blocking, erasure, or destruction of exempt manual data that is inaccurate or incomplete.

Section 44 lets the Commission order a data controller to rectify, block, erase, or destroy personal data on a data subject's complaint that it is inaccurate. Section 36 applies these rights to a credit bureau acting as a data controller, letting a data subject limit an information request to their financial standing and history for the twelve months before the request.

Section 75 lets the Commission serve a data controller who has contravened or is contravening a data protection principle with an enforcement notice requiring it to take or refrain from taking specified steps within a stated time, or to stop processing specified personal data. Section 76 lets the Commission cancel or vary an enforcement notice on its own motion or on the application of the person it was served on.

Section 77 lets a person affected by processing request the Commission to assess whether it complies with the Act, and section 78 lets the Commission make a formal determination that processing is inconsistent with the Act. Section 80 makes it an offence, carrying a fine of not more than one hundred and fifty penalty units or imprisonment of not more than one year or both, to fail to comply with an enforcement notice or an information notice, or to make a false statement in response to one.

Section 43 entitles an individual who suffers damage or distress through a data controller's contravention of the Act to compensation from that data controller, subject to the defence that the data controller took reasonable care to comply. Section 88 bars a person from purchasing, knowingly obtaining, or knowingly or recklessly disclosing another person's personal data, and section 89 bars selling or offering to sell personal data.

Section 95 sets the residual penalty for an offence under the Act with no penalty otherwise specified at a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both. The Judicial Service of Ghana's criminal bench book states that a penalty unit is twelve Ghana cedis (GH¢12), which puts the most that section 95 allows at sixty thousand Ghana cedis.

Section 37(1) prohibits processing personal data relating to a child under parental control, or to an individual's religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life, or criminal behaviour, unless the Act otherwise provides.

Section 37(2) permits a data controller to process special personal data only where the processing is necessary or the data subject consents, and section 37(3) treats processing as necessary where it exercises or performs a right or obligation the law imposes on an employer. Section 37(4) permits processing without consent only to protect the vital interests of a data subject who cannot give it, cannot reasonably be expected to give it, or has unreasonably withheld it.

Section 37(5) permits processing for the legitimate activities of a non-profit political, philosophical, religious, or trade union body, limited to its own members and never disclosed to a third party without the data subject's consent. Section 37(8) bars processing special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.

Section 38 exempts a spiritual or religious organisation, or an institution founded on religious or philosophical principles, from the prohibition on processing data about religious or philosophical belief where the processing concerns its own members, employees, or persons belonging to it.

The National Identity Register Act, 2008 (Act 750) was assented to on 28 January 2008 and notified in the Gazette on 15 February 2008. Section 2 establishes the National Identity Register as an electronic database that the Executive Secretary of the National Identification Authority keeps and maintains. Section 4(3) requires the personal information of a registered individual to include a recorded fingerprint or other biometric information determined by the Board, and a photograph.

Section 75 defines a national identity card as an identity card with a personal identification number issued by the Authority for the identification of the individual to whom it is issued.

Section 75 defines a user agency as including the Social Security and National Insurance Trust, the National Health Insurance Service, the Revenue Agencies Governing Board, the Ghana Immigration Service and any other public or private organisation approved of by the Minister which requires identity data from the Authority.

Section 48(1) permits the Authority to provide a person with personal information from an individual's entry in the Register if that person obtains the prior consent of the individual and makes the application with the authority of that individual. Section 48(3) bars a person provided with personal information under section 48(1) from using it for any other purpose unless one of four listed grounds applies.

Section 50(3) bars a person from making available any record of personal information received by a registration official to an unauthorised person or a person not entitled to receive the information. Section 50(4) makes a contravention of section 50 an offence punishable on summary conviction by a fine of not more than 250 penalty units or imprisonment of not more than two years or both.

Section 53(2) requires a user agency that accesses, uses, retains or discloses personal information from the Authority to comply with the applicable provisions of Part II of the Act and the guidelines the Authority issues.

Section 54(1) requires a user agency that intends to access an individual's personal information from the Authority's database to take reasonable steps to ensure that the individual is aware of the authority for the access, the purpose for which the information is required and the intended recipient.

Section 56 bars a user agency from using personal information obtained from the Authority for any purpose other than the one it was obtained for, unless the individual authorises the use, the use is authorised or required by law, or another ground listed in that section applies.

Section 57(1) bars a user agency from disclosing personal information it holds to any other person unless the individual has consented, the disclosure is required or authorised by law, or another ground listed in that subsection applies. Section 57(2) bars a person to whom personal information is disclosed from disclosing it for a purpose other than the purpose for which it was provided.

Section 58(1) permits a user agency to use or disclose personal information only where the use or disclosure does not invade the privacy of the individual concerned. Section 59 requires a user agency that holds personal information to secure and store it in accordance with the guidelines the Authority issues.

Section 41(1) makes it an offence, punishable on summary conviction by a fine of not more than 450 penalty units or imprisonment of not more than three years or both, to use a national identity card other than the one issued for the person's own use, or to permit another person to use a card issued to someone else, among other listed acts.

Section 41(3) makes it an offence, punishable on summary conviction by a fine of not more than 500 penalty units or imprisonment of not more than four years or both, to take or keep possession without reasonable cause of a national identity card that is false, that the person knows to be improperly obtained, or that belongs to another person.

Section 42 bars a person from using equipment or apparatus to produce a national identity card without the approval of the Authority, or to produce a false card, and makes a contravention punishable on summary conviction by imprisonment of not more than five years.

Section 66(1) makes it an offence, punishable on summary conviction by a fine of not more than 5,000 penalty units or imprisonment of not more than ten years or both, for an unauthorised person to cause a computer or other electronic device of the Authority to perform a function with intent to obtain access to a programme or data it holds, or to attempt to access personal information it holds contrary to the Act.

Section 68 bars a person from communicating to any other person a number, code, password or other means to access personal information contained in a computer of the Authority, other than to a person the first person is duly authorised to communicate it to, and makes a contravention punishable on summary conviction by a fine of not more than 2,500 penalty units or imprisonment of not more than five years or both.

Section 70(1) sets a penalty for an offence under the Act for which no penalty is specified of a fine of not more than 250 penalty units or imprisonment of not more than two years or both.

Section 70(2) makes every director, manager, partner, secretary or officer of a body corporate that commits an offence under the Act liable to the penalty provided for that offence, and section 70(3) excuses a person who proves the offence was committed without that person's consent or connivance and that due diligence was exercised.

Section 73(1)(f) lets the Minister make regulations to provide that every public office should demand the presentation of an identity card as a condition precedent to the provision of its service. Section 73(2) sets the penalty for contravention of regulations made under the Act at a fine of not more than 2,500 penalty units or imprisonment for a term of not more than five years.

The Authority states that section 3 of the National Identity Register (Amendment) Act, 2017 (Act 950) requires an applicant for registration to establish eligibility by providing any one of a birth certificate, a valid passport, a valid certificate of acquired citizenship, or other information the Authority requires.

The National Identity Register Regulations, 2012 (Legislative Instrument 2111) were made on 20 February 2012 under section 73(1) of the National Identity Register Act, 2008 (Act 750). The Regulations were notified in the Gazette on 21 February 2012 and entered into force on 23 March 2012.

Regulation 7(1) provides that a national identity card issued to an individual is to be used for the listed transactions where identification is required, including opening of individual or personal bank accounts, purchase of insurance policies, consumer credit transactions, payment of taxes and registration of SIM cards.

Regulation 7(2) requires an organisation that offers any of the services in respect of the transactions listed in regulation 7(1) to demand the presentation of a national identity card from the individual concerned before providing the relevant service to the individual.

The Authority published Gazette No. 65 of 8 July 2015 in exercise of its power under regulation 7(1)(n), which lists admission into an educational institution, issuance of a residence permit to a foreign national, issuance of a permit to foreign nationals permanently resident and all financial transactions as transactions requiring the mandatory use of the national identity card.

Regulation 8(1) allows the Authority, a user agency, a person authorised by law, or a law enforcement officer to request an individual who has been issued with a national identity card to produce it for inspection, and requires the card to be returned immediately unless there is reasonable suspicion of the commission of an offence.

Regulation 9(1) allows a person who has requested a card under regulation 8(1) and has reason to believe that it was not issued by the Authority to use a portable identity card reader to view the information stored on the card and to scan the individual's fingerprints and match them against the template stored on the card or in the national database through a secured link.

Regulation 22 defines a portable identity card reader as an instrument that cannot keep a record of any fingerprint that is scanned and is of a type approved by the Authority.

Regulation 9(2) makes it an offence, punishable on summary conviction by a fine of not more than 100 penalty units or imprisonment of not more than six months or both, for a person without reasonable excuse to refuse to surrender a national identity card to allow a law enforcement officer or an authorised person to view the information or scan a fingerprint on the card.

Regulation 13(1) provides that the conditions under which data in the custody of the Authority may be accessed are in accordance with a personal information sharing agreement as set out in Form Three of the Schedule, in addition to other conditions specified in the Regulations.

Regulation 15(2) requires a user agency that intends to access personal information of an individual to state the purpose for which the information is required and to satisfy the Authority that the individual is aware of and has authorised the request. Regulation 18(1) requires a user agency that uses personal information for administrative purposes to retain it only for a period determined by the Authority under its guidelines or as specified in the Data Sharing Agreement Form.

Regulation 18(2) requires a user agency that obtains personal information to secure and store it in accordance with the Authority's guidelines or as specified in the Data Sharing Agreement.

Section 94 punishes a person who, without lawful authority, retrieves subscriber information or intercepts traffic data or content data. This offence is narrower than the Electronic Transactions Act's general unauthorized-access offences: it binds a person dealing in communications data held by or passing through a service provider, rather than a general web crawler collecting data from public pages it does not own.

The Act also imposes retention and cooperation duties on a service provider, and creates a licensing regime for cybersecurity service providers, enforced by the Cyber Security Authority.

Section 124 punishes a person who intentionally accesses or intercepts an electronic record without authority or permission. Section 130 punishes a person who knowingly and without authority causes a computer to perform any function to secure access to a programme or electronic record held in that computer or any other computer, and section 131 punishes an unauthorized modification of a programme or electronic record.

Section 133 creates an aggravated offence, whoever knowingly accesses a computer without authorisation or exceeds authorised access to a protected computer, one holding information from a financial institution, a government department, a national-security matter, or otherwise designated protected, and carries the Act's highest tier. Section 134 punishes intentionally causing a computer to cease to function, including by virus or worm.

None of these provisions exempts a publicly accessible, unauthenticated page from the definition of unauthorized access, which the Act defines as access a person is neither personally entitled to nor has been given consent to obtain.

The Act's definition of a literary work, which section 1 makes eligible for copyright, includes encyclopedias, dictionaries, directories, time tables, anthologies, databases, or a compilation of data or other material, whether in machine-readable form, which by reason of the selection or arrangement of contents constitutes an intellectual creation.

Ghana has no separate sui generis database right: a database that is a mere collection of facts, without an original selection or arrangement, is not protected on that basis alone. Section 19's personal-use exception, which otherwise permits reproduction for a person's exclusive personal use, expressly does not extend to reproducing the whole or a substantial part of a database in digital form.

The Bank of Ghana issued this Directive under section 92(1) of the Banks and Specialised Deposit-Taking Institutions Act, 2016, among other powers. The Directive applies to institutions licensed or registered under the Banks and Specialised Deposit-Taking Institutions Act, 2016, and to those licensed under six further Acts, among them the Payment Systems and Services Act, 2019 and the Virtual Service Providers Act, 2025 as the Directive names it.

A regulated financial institution must be ISO/IEC 27001 certified and adopt ISO/IEC 27032. The board of a regulated financial institution must appoint a Chief Information Security Officer, subject to the prior written approval of the Bank of Ghana. A regulated financial institution must conduct a cyber and information security risk analysis at least once a year.

A regulated financial institution must conduct controlled penetration tests that cover network infrastructure, external and internal perimeters, and critical applications. A regulated financial institution must seek the prior approval of the Bank of Ghana to engage a managed security service provider. The Directive states that failure to comply with it will attract appropriate sanctions in accordance with applicable laws.

The Bank of Ghana's procedures for issuing directives state that a final directive has the force of law as prescribed under Act 930.

The Cyber Security Authority issued this Directive pursuant to sections 35 to 40 and 92 of the Cybersecurity Act, 2020. The Directive applies to all designated critical information infrastructure owners. A designated owner must appoint an accountable officer of senior management rank. A designated owner must review its approved cybersecurity policy at least once a year. A designated owner must conduct a quarterly cybersecurity risk assessment.

A designated owner must conduct yearly cybersecurity audits. A designated owner must create and keep a cybersecurity risk register. A designated owner must seek clearance from the Authority within one month before any major organisational change in operation, personnel and infrastructure. A designated owner must submit copies of reports covering audits, its risk register and any cybersecurity activities conducted, as the Directive requires.

An owner that fails to comply with a directive the Authority issues under section 92 of the Act is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.

The Minister may, on the advice of the Cyber Security Authority, designate a computer system or computer network as a critical information infrastructure where it is essential for national security or the economic and social well-being of citizens, and must publish the designation in the Gazette. The Authority must register each critical information infrastructure.

The owner of a registered critical information infrastructure must inform the Authority within seven days after any change in its legal ownership. The owner of a critical information infrastructure must cause an audit to be performed on it and submit a copy of the audit report to the Authority. The Authority carries out a periodic audit and inspection of each critical information infrastructure.

The Minister prescribes minimum standards for the general management of a critical information infrastructure. Failing to notify a change of ownership is an administrative penalty of not less than five hundred penalty units and not more than ten thousand penalty units. Failing to cause the audit to be performed is an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.

Failing to submit a copy of the audit report to the Authority carries the same administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.

A person may not provide a cybersecurity service in Ghana without a licence issued by the Cyber Security Authority. The First Schedule defines a cybersecurity service as one provided for reward and aimed at ensuring or safeguarding the cybersecurity of a computer or computer system.

Its list runs from penetration testing, forensic examination, incident response and threat hunting through to designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within the licensing duty even without performing any of the Schedule's other listed services.

A granted licence runs for two years and must be renewed at least one month before expiry, may not be transferred, and may not be used for a purpose other than the one for which it was granted. Providing a cybersecurity service without a licence carries an administrative penalty equal to the cost of the damage caused and the value of the financial gain made rather than a fixed sum, while transferring a granted licence is a separate criminal offence.

The Cyber Security Authority must develop, establish and adopt standards for cybersecurity covering education and skills development, hardware and software engineering, governance and risk management, research and development, and any other area it determines in line with international best practice. It must publish them on its website, and take the necessary measures to enforce them and monitor compliance by the public and private sectors.

A person who breaches an adopted standard is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units, payable to the Authority.

The Act names no size or sector gate for this duty and states no criminal penalty for a breach; the specific technical content of a standard the Authority adopts under this section, including whatever it requires of hardware and software engineering, is set outside the Act's own text and is not described here.

A regulated financial institution must report cyber and information security incidents to the Bank of Ghana on a monthly basis, in a report submitted by the 15th of each month that summarises all incidents in the past month. A regulated financial institution that recorded no cyber security incident must submit a nil report. A regulated financial institution must submit ad-hoc reports to the Bank of Ghana immediately, informing it about an incident as it starts, unfolds and terminates.

A regulated financial institution must notify the Bank of Ghana immediately of an incident damaging information integrity, a shutdown of production systems that hold sensitive information for over three hours, a leak of sensitive customer information, and the other events paragraph 50(7) lists.

A regulated financial institution must notify the Bank of Ghana immediately of any AI/ML-specific incident that results in, or has the potential to result in, material financial loss to the institution or its customers. The Directive states that failure to comply with it will attract appropriate sanctions in accordance with applicable laws. The Bank of Ghana's procedures for issuing directives state that a final directive has the force of law as prescribed under Act 930.

A designated critical information infrastructure owner must report all cybersecurity incidents to the relevant Sectoral Computer Emergency Response Team, or directly to the National Computer Emergency Response Team where none exists, within twenty-four hours of becoming aware of an incident. A designated owner must establish a point of contact for reporting cybersecurity incidents and receiving cybersecurity information, including security advisories relevant to its sector.

A designated owner must disclose and report any vulnerabilities identified or discovered through internal or external security audits and assessments within 72 hours of identifying or discovering the vulnerability. An owner that fails to comply with a directive the Authority issues under section 92 of the Act is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.

The owner of a critical information infrastructure must report a cybersecurity incident within twenty-four hours after the incident is detected to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the infrastructure does not belong to a Sectoral Computer Emergency Response Team.

The Act defines a cybersecurity incident as any act or attempt, successful or unsuccessful, to gain unauthorised access to, disrupt or misuse an information system or information stored on such information system. Failing to report is an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.

The person in charge of any institution, public or private, must report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where no Sectoral team covers that institution, within twenty-four hours after the incident is detected.

A cybersecurity service provider licensed by the Cyber Security Authority carries a further duty to submit a periodic report on its own operations, including any cybersecurity incident, within a period the Authority determines. Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Authority, rather than a criminal offence.

Section 19(1)(b) of the Copyright Act, 2005 (Act 690) permits, without the copyright owner's consent, the inclusion of quotations from a work in another work, including quotations from articles in newspapers or periodicals in the form of press summaries, provided the work quoted has been made public.

Section 19(3) makes this conditional on the quotation being compatible with fair practice, with its extent not exceeding what is justified for the purpose of the work in which it is used, and on the source and the author's name being indicated. Section 19 carries no headline-length or short-extract cap distinct from this fair-practice test, and no reported Ghanaian decision applies it to a systematic news aggregator rather than an individual quoting a published work.

Neighbouring rights under the Act, covering performers and broadcasting organisations, do not extend to a print or online news publisher's own reporting.