Ghana

Ghana regulates personal data through the Data Protection Act, 2012 (Act 843), one of the earlier comprehensive statutes in anglophone West Africa, assented to on 10 May 2012 and in force from 16 October 2012. It applies to any person who collects, processes, holds, or uses personal data in Ghana, and extends to controllers established abroad that use equipment in Ghana (other than for transit). The Act establishes the Data Protection Commission, requires all controllers to register before processing, and maintains a public Data Protection Register. It articulates core principles (purpose limitation, adequacy, accuracy, retention limits, security), generally requires consent, and applies restricted grounds to special categories (health, race or ethnicity, political opinions, religious belief, biometrics, criminal records, sexual orientation). Data subjects have rights of access, rectification, prevention of harmful processing, prevention of direct marketing, objection to automated decision-making, and compensation for non-compliance. Cross-border transfers are restricted to countries with adequate protection or where conditions such as consent are met, and criminal penalties apply for serious breaches. Enforcement rests with the Data Protection Commission (DPC), Ghana's independent supervisory authority, empowered to register controllers, maintain the Register, investigate complaints, and enforce compliance. With an established in-force Act and an operational named regulator, Ghana has one of the more settled anglophone regimes in the region, though its 2012 registration-centred design predates the GDPR accountability generation.