Ghana. Comprehensive data protection. Act
Act 843Data Protection Act, 2012 (Act 843)
§1Summary
- Synopsis
Ghana's data protection statute, based on the UK DPA 1998 model, setting eight privacy principles and establishing the Data Protection Commission. It requires all data controllers to register and gives individuals access, correction and objection rights.
- Key themes
- Unique features
Universal registration: all data controllers (including foreign ones processing in Ghana) must register with the DPC and renew every two years, and the DPC has pursued prosecutions of defaulting institutions. Large controllers are expected to appoint a certified 'data supervisor' rather than a DPO.
- SaaS relevance
A SaaS provider processing personal data in Ghana or using equipment there must register with the DPC; foreign controllers register as external companies.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- DPC and data subjects as soon as reasonably practicable
- DPO
- Conditional
- Cross-border transfers
- No specific transfer regime
- Maximum penalty
- Up to 2,500 penalty units and/or 5 years' imprisonment (sale of personal data)
§3Dates
- Key dates
- Adopted
- In force
- Data Protection Commission operational from 2014; replacement Data Protection Bill 2025 under consultation (not enacted as of Oct 2026)
§4Text and authority
- Text
- Authoritative text dpc.gov.gh
- Authority
- Data Protection Commission (DPC)
§5Where it applies
- Domestic law of
- Ghana
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Data Protection Bill 2025 proposed to replace Act 843; parliamentary status not verified (search budget exhausted).