Data protection & privacy laws in Ghana (2026)

The Data Protection Act, 2012 (Act 843) is the primary data protection statute, establishing principles of lawful processing, data minimisation, purpose limitation, and security safeguards applicable to all data controllers operating in Ghana.

The Data Protection Commission (DPC), established under Act 843, is the independent body responsible for protecting individual privacy, registering data controllers, investigating complaints, and enforcing compliance.

All data controllers must register with the DPC and renew registration every two years, paying prescribed fees; failure to register is an offence under Act 843.

Act 843 grants individuals rights of access, correction, and objection to processing of their personal data; the pending 2025 Bill substantially expands these rights and asserts that personal data remains the legal property of the data subject.

Act 843 requires data controllers transferring personal data abroad to ensure the receiving jurisdiction provides equivalent protection; the 2025 Bill proposes clearer adequacy and transfer-mechanism provisions aligned with modern international standards.

The Data Protection Bill 2025, published by the Ministry of Communications and the DPC, proposes to replace Act 843 with a GDPR-influenced regime including a 72-hour breach notification duty, mandatory Data Protection Officers, Data Protection Impact Assessments for high-risk processing, and a new Data Protection Authority with broader enforcement powers. As of May 2026 it had not been formally passed by Parliament.