Data protection & privacy law in Ghana (2026)

By a 4-1 majority, the Supreme Court held that linking a citizen's Ghana Card to a mobile SIM without consent breaches Article 18(2) of the 1992 Constitution, awarding GH₵10,000 in general damages. The ruling establishes binding judicial precedent connecting the constitutional privacy guarantee to digital identity and telecoms practices.

Ghana's government opened the draft Data Protection Bill 2025 for public consultation (17 October–28 November 2025), proposing to replace Act 843 with a comprehensive statute creating an independent Data Protection Authority, mandatory DPIAs, cross-border transfer rules, children's data protections, and stronger sanctions. Cabinet approval and parliamentary introduction are anticipated in 2026.

The DPC published detailed Guidelines to Demonstrate Data Protection Compliance and a separate DPIA FAQ document, giving data controllers and processors a formal compliance roadmap under Act 843 for the first time, including risk assessment requirements for high-risk processing activities.

Within weeks of its enforcement declaration, the DPC arrested representatives from five organisations that were processing personal data without registering with the Commission—the first use of criminal sanctions under Act 843 and a signal that the decade-long educational phase was over.

After a decade of largely advisory operations, the Data Protection Commission announced that enforcement of Act 843 was in full force, warning that unregistered data controllers faced prosecution, fines, and imprisonment under Sections 27 and 56 of the Act.

The Ministry of Communications and the DPC launched upgraded online registration and compliance software and declared a six-month amnesty (1 October 2020–31 March 2021) under Section 97 of Act 843, incentivising previously non-compliant data controllers to register without facing immediate penalties.

Act 989 was assented to and entered force in January 2020, granting citizens access to information held by public bodies while incorporating privacy exemptions that interact with Act 843, completing a two-pillar information-rights framework for Ghana.

Act 843 became effective, activating the Data Protection Commission as an independent statutory body, establishing the Data Protection Register, and making registration mandatory for all data controllers — Ghana's first operational data protection regime.

The 1992 Constitution came into force with Article 18(2) guaranteeing every person's right against interference with the privacy of their home, property, correspondence, or communication. This clause became the explicit constitutional basis on which all subsequent data protection legislation, including Act 843, was grounded.