AWFLWIKIWORLD| Ghana Data Protection Act and Data Protection Commission | |
|---|---|
 | |
| Act Name | Data Protection Act, 2012 (Act 843) |
| Commission | Data Protection Commission (DPC) |
| Established | 2012 - operational 2016 |
| Executive Director | Patricia Adusei-Poku |
| Ministry | Ministry of Communication and Digitalisation |
| Location | Accra Digital Centre, Accra |
| Registration | All data controllers must register with DPC |
| Penalty | Up to 5 years jail for breach |
What is Ghana Data Protection Act and Data Protection Commission
Data Protection Act, 2012 (Act 843) is the law that protects personal data of Ghanaians.
Data Protection Commission (DPC) is the agency that enforces the law and protects privacy.
The Act makes it illegal for companies, churches, schools, hospitals to collect and share your personal data without consent.
History
Act was passed in 2012 but implementation started in 2016 when Executive Director Patricia Adusei-Poku was appointed.
Ghana was one of first countries in Africa to have data protection law - after Mauritius and Tunisia.
Act 843 was based on UK Data Protection Act and EU model before GDPR.
In 2020, Data Protection Regulations - L.I 2223 - were passed to strengthen enforcement.
Key Provisions of Act 843
1. Who Must Register
- Every organisation that collects personal data - data controller
- Examples: Banks (GCB, Ecobank), Telcos (MTN, Telecel, AT), Hospitals (Korle-Bu), Schools (UG, KNUST), Churches, Supermarkets, NGOs, Government (NIA, DVLA, GRA)
- Must register with DPC and pay - GHS 500 to GHS 10,000 depending on size
2. Data Subject Rights
- Right to know what data is collected
- Right to consent - must agree before collection
- Right to object - can say no to marketing
- Right to be forgotten - can ask to delete your data
- Right to complain to DPC if breached
3. Data Protection Principles
- Collect only what you need - not everything
- Keep data accurate and up to date
- Keep data secure - encrypt, password protect
- Do not keep longer than necessary
- Do not share without consent
4. Sensitive Personal Data
- Special protection for: Health data, Biometric (Ghana Card fingerprints), Religious belief, Sexual life, Criminal record, Political affiliation
- Cannot process without extra consent
5. Data Breach Notification
- Must report breach to DPC within 72 hours
- Must inform affected persons
Enforcement Actions
- DPC fined MTN, banks, and loan apps for breach - 2022-2024
- Operation to close down illegal loan apps - Sika Purse, Fast Loan, etc. - charging high interest and sharing contact data
- Warning to churches and schools collecting data without registration
- Over 5,000 organisations registered by 2024 - target is 100,000
Connection to Ghana Card and NIA
NIA collects biometric data for Ghana Card - DPC regulates how NIA stores and shares data.
Ghana Card data cannot be shared without Data Protection Commission approval and citizen consent.
This protects against identity theft.
Relation to Cybersecurity Act
- Data Protection Commission - protects privacy and personal data
- Cyber Security Authority (CSA) - protects systems from hacking
- Both work together at Accra Digital Centre
Both needed for digital Ghana - your MoMo, bank, Ghana Card must be secure AND private.
Challenges
- Many companies not registered - especially SMEs, churches, schools
- People do not know their rights - low awareness
- Loan apps sharing contact lists - shaming borrowers
- No data - many companies still use paper
- Enforcement weak - small fines
How to Complain
- Visit: www.dataprotection.org.gh
- Email: dpc@dataprotection.org.gh
- Location: Accra Digital Centre
- If company leaks your data, uses your picture without consent, or bombards you with SMS