Data Protection Act 2012

· About Data Protection Act 2012

Key Takeaways

  • The Data Protection Act, 2012 (Act 843) applies to both public and private bodies in Ghana that collect, hold, process, or use personal data, and it is enforced by the Data Protection Commission.[1][14]
  • The Act remains in force in 2026; the official consolidated text on GhaLII describes itself as the latest version, and no enacted 2025–2026 amendment or repeal was identified in the available official material.[1][5]
  • A data controller must register with the Commission before processing personal data in covered circumstances, and unlawful processing without registration can attract criminal liability, including fines and imprisonment.[3][13]
  • The Act creates specific offences for non-compliance with enforcement or information notices, unlawful sale of personal data, and other breaches, with penalties measured in penalty units and possible prison terms.[2][3][6]
  • A 2025 draft Data Protection Bill appears to propose replacing Act 843 and creating a new Data Protection Authority, but it is a bill, not current law, and it expressly repeals Act 843 only if enacted.[5][9]
  • Because Ghana’s current regime still relies on criminal sanctions, compliance programmes should combine legal controls, security governance, and accountability documentation, not only privacy notices and contracts.[2][3][14]

What It Is

The Data Protection Act, 2012 (Act 843) is Ghana’s core privacy statute governing the collection, use, disclosure, storage, and other processing of personal data by both the public and private sectors.[1][14] It establishes the Data Protection Commission (DPC) as the independent statutory body responsible for administering and enforcing the regime.[14]

The official text was adopted in 2012 and is recorded on the official and quasi-official repositories as Act 843, with the source text dated 18 May 2012.[1][3] The Act is currently in force in 2026; the available sources do not show a 2025 or 2026 enacted amendment that has replaced it, although a Data Protection Bill, 2025 has been published in draft form and would repeal Act 843 if passed.[1][5][9]

Key phase-in milestones in the current law are not presented as a modern GDPR-style implementation calendar; instead, obligations are triggered by conduct such as processing personal data, operating as a controller, failing to register, or ignoring a Commission notice.[2][3][14] The practical compliance date for most organisations is therefore the date they begin processing personal data in Ghana or targeting Ghanaian data subjects through a covered operation.[1][14]

Who Must Comply

The Act applies broadly to data controllers and processors involved in personal data processing in Ghana, including both private organisations and public-sector bodies.[1][14] The Commission’s own description confirms that the statute regulates the processing of personal information across sectors.[14]

The available sources do not identify a narrow revenue, employee-count, or data-volume threshold for the Act itself; instead, the regime is activity-based and attaches when an entity processes personal data or falls within statutory controller obligations.[1][3] The law also reaches conduct outside the core collection setting, including disclosures, sales, and other uses of personal data that are criminalised in the Act.[3][6]

Exemptions are not described in the retrieved official materials as a general carve-out for small organisations, foreign companies, or low-risk processing.[1][14] For cross-border compliance, the key practical issue is whether the organisation is processing personal data connected to Ghana and triggering controller obligations, even if it is headquartered elsewhere.[13][14]

Core Requirements

  1. Register as a data controller where required. The Act requires registration of data controllers with the Commission, and processing without registration can lead to criminal liability.[3][13]
  1. Process personal data lawfully and within the statutory framework. The Act regulates how personal data may be collected, used, disclosed, and otherwise handled, and unlawful conduct can create offence exposure.[1][3]
  1. Comply with Commission notices promptly. Failure to comply with an enforcement notice or information notice is an offence, punishable on summary conviction by a fine of up to 150 penalty units or imprisonment of up to one year, or both.[2]
  1. Avoid unlawful disclosure or sale of personal data. The Act separately criminalises obtaining, disclosing, or selling another person’s personal data in specified circumstances, with higher penalties for sale-related conduct.[3][6]
  1. Maintain organisational controls that support accountability and security. While the retrieved sources do not provide a GDPR-style article-by-article security annex, the Commission’s mandate and the Act’s offence structure make governance, records, and internal controls necessary to reduce enforcement risk.[14][2]
  1. Treat the penalties as criminal, not merely administrative. Many violations under Act 843 are prosecuted as offences and may result in fines, imprisonment, or both, which raises the compliance bar above ordinary civil privacy regimes.[2][3][6]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Act adopted | 18 May 2012 | Data Protection Act, 2012 (Act 843) is enacted.[1][3] | | Current status confirmed | 2026 | Act 843 remains the operative law; a 2025 bill is only proposed legislation.[1][5][9] | | Controller registration trigger | Ongoing | Controllers must register when covered by the Act’s registration regime.[3][13] | | Compliance with notices | Ongoing | Enforcement and information notices must be obeyed.[2] |

The maximum sanctions identified in the current sources include:

  • Failure to comply with an enforcement notice or information notice: up to 150 penalty units or 1 year imprisonment, or both.[2]
  • Processing personal data without registration: up to 250 penalty units or 2 years imprisonment, or both.[3][13]
  • Unlawful sale of personal data: up to 2,500 penalty units or 5 years imprisonment, or both.[3][6]
  • General penalty where no specific sanction is stated: up to 5,000 penalty units or 10 years imprisonment, or both.[3][6]

Other sanctions include criminal conviction, potential prosecution under the Act’s offence provisions, and regulatory intervention by the Commission through notices and compliance actions.[2][14] The draft 2025 bill, if enacted, appears to introduce a different penalty architecture, but that is not current law.[5][8]

How to Comply

  1. Map all personal data processing. Identify data categories, purposes, legal bases, recipients, retention periods, and cross-border transfers, then document which business units and vendors are in scope.
  1. Determine registration status with the Commission. Confirm whether the organisation is a registrable data controller under Act 843 and keep registration evidence current, especially for higher-risk or public-facing processing.[3][14]
  1. Build a governance framework aligned to ISO 27001. Use ISO 27001 controls for access management, incident handling, asset inventory, supplier security, and logging to support the Act’s accountability and security expectations.
  1. Implement privacy operating processes aligned to NIST CSF 2.0. The Identify, Protect, Detect, Respond, and Recover functions map well to personal data governance, breach response, and resilience, even though the Act is not written in NIST terms.
  1. Adopt an AI and privacy management layer where automation is used. If personal data feeds AI or automated profiling, use ISO 42001 for governance, impact assessment discipline, and control ownership.
  1. Create notice and response workflows for Commission requests. Since failure to comply with enforcement or information notices is an offence, maintain a short internal escalation path for legal review, evidence collection, and deadline tracking.[2]
  1. Restrict sale and disclosure of personal data. Put explicit approval controls around secondary use, onward transfer, and any monetisation activity, because the Act criminalises unlawful sale and related disclosure conduct.[3][6]
  1. Test the programme with audits and tabletop exercises. Run periodic audits of registrations, policies, and incident response, and rehearse regulator-facing responses and records production.

Related Regulations

  • The proposed Data Protection Bill, 2025 appears intended to replace Act 843 and establish a new Data Protection Authority, so it is the most direct legislative overlap, but it is not yet current law.[5][9]
  • Ghana’s Electronic Transactions Act, 2008 (Act 772) overlaps on electronic records and online activity, which can create parallel compliance obligations for digital processing.
  • Ghana’s Cybersecurity Act, 2020 (Act 1038) overlaps on cyber incident handling, security governance, and protected systems, especially where data protection incidents are also security incidents.
  • Sector-specific confidentiality rules, such as financial-services or health-sector duties, can add stricter handling and reporting requirements on top of Act 843.
  • Where organisations operate across borders, the EU GDPR may still apply extraterritorially, creating dual-regime obligations for Ghana-facing and EU-facing processing.

FAQ

Does Ghana’s Data Protection Act 2012 apply to companies outside Ghana?

Yes, if the company processes personal data connected to the Ghanaian market or otherwise falls within the Act’s controller obligations.[1][14] The available sources do not show a residency-based exemption for foreign entities. Cross-border operations should assume the Act can apply where personal data processing is carried out in relation to Ghana.[13][14]

Do data controllers have to register with the Data Protection Commission?

Yes, controller registration is a core obligation under the Act’s enforcement structure.[3][13] Failure to register, where required, is a criminal offence with penalties up to 250 penalty units or 2 years’ imprisonment, or both.[3]

What are the biggest penalties under the Act?

The highest penalty identified in the current sources for a general offence is up to 5,000 penalty units or 10 years’ imprisonment, or both.[3][6] Separate offences also carry lower maximums, such as 150 penalty units for ignoring a Commission notice and 2,500 penalty units for unlawful sale of personal data.[2][3]

Has the 2012 Act been replaced by a new law in 2025 or 2026?

No enacted replacement was identified in the current sources as of 21 October 2026.[1][5][9] A Data Protection Bill, 2025 exists in draft form and would repeal Act 843 if passed, but that bill is not itself the operative law.[5][9]

Is a data breach notification deadline clearly stated in the current Act sources?

The retrieved official materials did not surface a clear breach-notification deadline in the same way modern GDPR-style regimes do.[1][3] Organisations should still treat incident response, internal escalation, and evidencing of compliance as essential because the Act’s enforcement model is offence-based and the Commission can issue notices.[2][14]

Sources

Put it into practice

More compliance guides