Data protection & privacy law in Ghana (2026)

Legal framework

Data Protection Act, 2012 (Act 843); supervised by the Data Protection Commission (DPC); Data Protection Bill 2025 pending parliamentary enactment to replace Act 843

Key points: data & privacy in Ghana

1. 01Comprehensive law in force

   The Data Protection Act, 2012 (Act 843) is the primary data protection statute, establishing principles of lawful processing, data minimisation, purpose limitation, and security safeguards applicable to all data controllers operating in Ghana.

   dataprotection.org.gh dlapiperdataprotection.com

2. 02Supervisory authority

   The Data Protection Commission (DPC), established under Act 843, is the independent body responsible for protecting individual privacy, registering data controllers, investigating complaints, and enforcing compliance.

   dataprotection.org.gh moc.gov.gh

3. 03Data controller registration

   All data controllers must register with the DPC and renew registration every two years, paying prescribed fees; failure to register is an offence under Act 843.

   dataprotection.org.gh dataprotection.org.gh

4. 04Data subject rights

   Act 843 grants individuals rights of access, correction, and objection to processing of their personal data; the pending 2025 Bill substantially expands these rights and asserts that personal data remains the legal property of the data subject.

   dataprotection.org.gh thebftonline.com

5. 05Cross-border transfer rules

   Act 843 requires data controllers transferring personal data abroad to ensure the receiving jurisdiction provides equivalent protection; the 2025 Bill proposes clearer adequacy and transfer-mechanism provisions aligned with modern international standards.

   dataprotection.org.gh oakslegal.net

6. 06Data Protection Bill 2025 (pending)

   The Data Protection Bill 2025, published by the Ministry of Communications and the DPC, proposes to replace Act 843 with a GDPR-influenced regime including a 72-hour breach notification duty, mandatory Data Protection Officers, Data Protection Impact Assessments for high-risk processing, and a new Data Protection Authority with broader enforcement powers. As of May 2026 it had not been formally passed by Parliament.

   moc.gov.gh dataprotection.org.gh thebftonline.com

Timeline of decisions

1. 25 Feb 2026Decision
   Supreme Court: Unauthorized Ghana Card–SIM Linking Violates Constitutional Right to Privacy

   By a 4-1 majority, the Supreme Court held that linking a citizen's Ghana Card to a mobile SIM without consent breaches Article 18(2) of the 1992 Constitution, awarding GH₵10,000 in general damages. The ruling establishes binding judicial precedent connecting the constitutional privacy guarantee to digital identity and telecoms practices.

   Modern Ghana (reporting Supreme Court judgment)

2. 17 Oct 2025Law · official
   Data Protection Bill 2025 Published for Public Consultation

   Ghana's government opened the draft Data Protection Bill 2025 for public consultation (17 October–28 November 2025), proposing to replace Act 843 with a comprehensive statute creating an independent Data Protection Authority, mandatory DPIAs, cross-border transfer rules, children's data protections, and stronger sanctions. Cabinet approval and parliamentary introduction are anticipated in 2026.

   Better Regulation Reforms Portal, Ghana

3. 1 Jul 2025Guidance · official
   Data Protection Commission Issues Compliance Guidelines and DPIA Framework

   The DPC published detailed Guidelines to Demonstrate Data Protection Compliance and a separate DPIA FAQ document, giving data controllers and processors a formal compliance roadmap under Act 843 for the first time, including risk assessment requirements for high-risk processing activities.

   Data Protection Commission, Ghana

4. 1 Sept 2023Enforcement
   DPC Arrests Representatives of Five Non-Compliant Organisations

   Within weeks of its enforcement declaration, the DPC arrested representatives from five organisations that were processing personal data without registering with the Commission—the first use of criminal sanctions under Act 843 and a signal that the decade-long educational phase was over.

   TechHive Advisory Africa

5. 14 Aug 2023Guidance
   DPC Declares Full Enforcement of the Data Protection Act

   After a decade of largely advisory operations, the Data Protection Commission announced that enforcement of Act 843 was in full force, warning that unregistered data controllers faced prosecution, fines, and imprisonment under Sections 27 and 56 of the Act.

   Business & Financial Times

6. 8 Oct 2020Guidance · official
   DPC Launches New Registration Software and Declares Six-Month Amnesty

   The Ministry of Communications and the DPC launched upgraded online registration and compliance software and declared a six-month amnesty (1 October 2020–31 March 2021) under Section 97 of Act 843, incentivising previously non-compliant data controllers to register without facing immediate penalties.

   Data Protection Commission, Ghana

7. 16 Oct 2012Law · official
   Data Protection Act 2012 (Act 843) Enters into Force, Establishes Data Protection Commission

   Ghana's Data Protection Act 843 entered into force, creating the Data Protection Commission (DPC) to regulate collection, processing, and use of personal data — with controller registration opening in January 2015. This became the primary indirect legal framework governing AI data use in Ghana, enforced by the DPC on all AI systems that process personal data.

   Ghana Data Protection Commission

8. 16 Oct 2012Law · official
   Data Protection Act 2012 (Act 843) Enters Into Force — DPC Becomes Operational

   Act 843 became effective, activating the Data Protection Commission as an independent statutory body, establishing the Data Protection Register, and making registration mandatory for all data controllers — Ghana's first operational data protection regime.

   GhanaLII — Parliament of Ghana

9. 1 Oct 2012Law · official
   Data Protection Act, 2012 (Act 843) enters into force

   Ghana's first dedicated data-privacy law established the Data Protection Commission, required all data controllers to register and observe data-protection principles, prohibited direct marketing without prior written consent, and provided both civil and criminal sanctions — extending online privacy rights to all data subjects in Ghana.

   Data Protection Commission, Ghana

10. 1 Jan 2012Law · official
    Data Protection Act 2012 (Act 843) enacted

    Act 843 established Ghana's data protection framework, creating the Data Protection Commission and imposing obligations on data controllers to implement security measures and to notify the Commission and affected data subjects of security breaches 'as soon as reasonably practicable.' It introduced Ghana's first legal breach-notification duty and remains in force alongside the Cybersecurity Act as a parallel compliance obligation.

    National Information Technology Agency (NITA)

11. 7 Jan 1992Law · official
    Ghana's Fourth Republican Constitution Enacted — Article 18(2) Establishes Right to Privacy

    The 1992 Constitution came into force with Article 18(2) guaranteeing every person's right against interference with the privacy of their home, property, correspondence, or communication. This clause became the explicit constitutional basis on which all subsequent data protection legislation, including Act 843, was grounded.

    GhanaLII — Parliament of Ghana

Sources

1. 1.dataprotection.org.gh/data-protection-act
2. 2.dataprotection.org.gh/
3. 3.moc.gov.gh/dpc/
4. 4.moc.gov.gh/wp-content/uploads/2023/03/DATA-PROTECTION-BILL.pdf
5. 5.dataprotection.org.gh/wp-content/uploads/2025/11/DATA_PROTECTION_BILL1_DRAFT-1.pdf
6. 6.dataprotection.org.gh/wp-content/uploads/2025/07/GUIDELINES-TO-DEMONSTRATE-DATA-PROTECTION-
7. 7.thebftonline.com/2026/05/20/the-data-protection-bill-2025-a-stronger-shield-what-is-it
8. 8.thebftonline.com/2025/11/21/understanding-the-data-protection-bill-2025-key-highlights
9. 9.dlapiperdataprotection.com/index.html?t=law&c=GH
10. 10.oakslegal.net/ghanas-data-protection-bill-2025-a-comparative-analysis-policy-assess
11. 11.dataprotection.org.gh/data-protection/fees-charges
12. 12.dataprotection.org.gh/data-protection-principles