Data protection after persuasion: what active enforcement in Ghana means for every organisation

The end of the grace period

Ghana has had a data protection law since 2012. For most of the time since, the Data Protection Commission (DPC) has concentrated on explaining it: campaigns, training, registration drives and reminders. Many organisations, reasonably, treated registration as paperwork they would get round to.

That period is over. In January 2026 the Commission's executive director said 2026 would be a year of enforcement.¹ In early October it began spot checks of organisations' registration and compliance.² On 13 October it reported that it had registered 2,575 data controllers in 2026, more than in any previous year, and said it would no longer rely solely on persuasion where organisations failed to comply.³ Registrations of new data controllers had risen by 98.4% in the first half of the year, according to the Minister for Communications.⁴

The first results of the new approach were public within days. After field visits on 12 October, the Commission referred a microfinance company to the police's Criminal Investigations Department for failing to renew its registration and complete its compliance report, directed a clinic to give a statement to the police for having no data protection supervisor, unpaid fees and the lack of a privacy impact assessment for its electronic health records, and found two hospitals operating on expired certificates. Its executive director said the Commission could not rely indefinitely on education and persuasion alone, and that its primary objective was compliance, not punishment for its own sake.⁵

This article explains what the law asks of organisations, what has changed, what is coming and what to do. It reports facts and is not legal advice; organisations with specific questions should read the Act and speak to the Commission or a qualified adviser.

What the law asks

The Data Protection Act, 2012 (Act 843) applies to any organisation that processes personal data in Ghana, and to some foreign organisations whose data originates in Ghana or that use equipment or processors here.⁶ In practice that means almost every employer, school, clinic, shop, church, landlord and service business, because almost every one of them holds names, phone numbers, staff files or customer records.

Its core duties are straightforward:

• Register, and renew. A data controller must register with the Commission (sections 27 and 46), must renew every two years (section 50) and, if unregistered, must not process personal data at all (section 53). Changes to registered details must be notified within 14 days (section 55).⁶
• Follow the eight principles. Section 17 lists accountability, lawful processing, a specified purpose, compatible further use, data quality, openness, security safeguards and the data subject's participation.⁶
• Collect only what you need, and keep it only as long as you need it. Data must be necessary, relevant and not excessive (section 19), collected for a specific and lawful purpose, and kept no longer than necessary (section 24).⁶
• Tell people. When collecting data, organisations must tell people the purpose, who will receive it and their right of access.⁶
• Keep it secure. Section 28 requires appropriate, reasonable technical and organisational measures, regular checks that they work and updates as risks change; processors must work under a written contract (section 30).⁶
• Report breaches. Where data is accessed by someone unauthorised, the controller must tell the Commission and the people affected as soon as reasonably practicable (section 31).⁶
• Respect people's rights. People can ask what is held about them, have it corrected or deleted where it is inaccurate, out of date, excessive or unlawfully obtained, object to processing that causes damage or distress, and refuse direct marketing without prior consent.⁶

The Commission's own guidance of July 2025 turns these duties into a self-assessment covering governance, policies, a record of processing activities, staff training, rights requests, processor contracts, risk and impact assessments, privacy by design and breach response. Medium and large controllers must appoint a designated data protection supervisor; small controllers are exempt.⁷

What non-compliance costs

The fees for complying are modest beside the cost of not doing so. Under the Commission's current schedule, registration costs GH₵156 for a small controller, GH₵1,170 for a medium one, GH₵2,340 for a large one and GH₵5,000 in specialised industries.⁸

Processing personal data without registering is an offence under section 56, punishable by a fine of up to 250 penalty units, up to two years' imprisonment, or both.⁶ At GH₵12 a penalty unit, that fine is up to GH₵3,000.⁹ The sum is small; the prospect of a criminal referral, a police statement and a public report naming the organisation is not. That is precisely the lever the Commission has begun to pull.⁵

Other sanctions in the Act are heavier. Failing to comply with an enforcement notice carries up to 150 penalty units or a year in prison, and selling personal data up to 2,500 penalty units or five years.⁶ People who suffer damage or distress because of a breach of the Act can also seek compensation.⁶

The incidents behind enforcement are familiar. In January 2026 the Commission said complaints kept arriving about unauthorised digital loans, improper disclosure of health records and the unlawful reuse of personal data.¹ In April 2025 a major telecoms operator confirmed that about 5,700 customers may have been affected by unauthorised access to personal information, and the Commission investigated.¹⁰ In October 2025 it opened a probe into the handling of patient data on a national health records system.¹¹ Each is a reminder that the Act is not about paperwork. It is about what happens to people when their information is mishandled.

A second deadline at the front desk

A separate law, enforced by the National Identification Authority rather than the Commission, reaches into the same everyday practices.

The National Identity Register (Amendment) Regulations, 2026, in force from 9 June 2026, bar organisations from requesting, keeping, reproducing or relying on photocopies, scans or images of the Ghana Card, or relying on a visual check alone. Verification must go through the Authority's own systems, and the transition period ends on 2 November 2026.¹² Fines for organisations range from GH₵6,000 to GH₵24,000.¹³

For reception desks, HR files, customer onboarding and loan applications, this is a practical change with a date attached. Many organisations hold boxes of photocopied cards and shared folders of scans. Under both laws, the safest data is data never collected: verify identity through the official route, record that the check was done, and do not keep the copy.

Where the law is going

Act 843 is likely to be replaced. The Ministry of Communication, Digital Technology and Innovations consulted on a draft Data Protection Act in October 2025.¹⁴ As described by a Ghanaian law firm in July 2026, the draft would create a new Data Protection Authority with corrective powers and administrative fines, extend the law to organisations outside Ghana that offer goods or services to people here or monitor their behaviour, and add data portability and a right to erasure.¹⁵ There is no evidence that it has been passed; Act 843 remains the law.

The direction matches the region. Nigeria's data protection regulator fined a major bank ₦555.8 million in 2024 and a pay-television company ₦766 million in 2025.¹⁶¹⁷ Kenya's regulator issued penalty notices totalling KSh 9.375 million against a digital lender, a lounge and a school in late 2025, including for posting children's data.¹⁸ South Africa's Information Regulator issued a R5 million infringement notice to its own Department of Basic Education in December 2024.¹⁹ In Europe, regulators imposed about €1.2 billion in GDPR fines in 2025, €7.1 billion since 2018.²⁰

The lesson is not that large fines are imminent in Ghana. It is that the region has moved from law on paper to law in practice, and Ghana has now joined it.

A practical checklist

For most organisations, compliance is a handful of steady habits rather than a project. In rough order:

1. Check your registration status today. Confirm that your organisation is registered, that the certificate has not expired and that renewal is diarised well before the two-year anniversary.⁶ The Commission's message during its spot checks was simply to check your status and regularise your compliance.²
2. Map what you hold. List the personal data you collect (staff, customers, visitors, students, patients, suppliers), why, where it is kept, who can see it and who you share it with. This is your record of processing activities, and the Commission's guidance expects one.⁷
3. Cut what you do not need. Stop collecting fields you never use. Destroy or anonymise records you no longer need, on a written schedule.⁶
4. Stop copying the Ghana Card. Move to verification through the Identification Authority's systems before 2 November 2026, and plan how to dispose of existing copies securely.¹²
5. Write notices people can actually read. At every point of collection, including reception, forms and websites, say what you collect, why, who receives it and how to ask for it. Keep a record of what each notice said and when.
6. Appoint a supervisor if you must, and an owner regardless. Medium and large controllers must appoint a designated supervisor.⁷ Every organisation should have one named person who owns data protection.
7. Secure the basics. Limit access by role, use strong sign-in for systems with personal data, lock paper records away and keep an audit trail of who saw and changed sensitive records.⁶
8. Put processors under contract. Payroll bureaus, software providers, cloud services and couriers that handle your data on your behalf need written contracts covering security and confidentiality.⁶
9. Rehearse a breach. Decide in advance who investigates, who tells the Commission and how you will notify the people affected.⁶
10. Make rights requests easy. Give people one address to ask for their data, a correction or a deletion, and a person responsible for answering promptly.
11. Assess new systems before launch. A privacy impact assessment for a new records system, app or CCTV installation is now something inspectors ask about.⁵
12. Train staff each year. Most failures are human. Short, regular training is required for larger controllers and sensible for everyone.⁹

Enforcement is unwelcome only to organisations that were never going to comply. For the rest, a regulator that inspects is good news: it rewards the work they have done and raises the floor for everyone their customers deal with.