{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Bentsi-Enchill, Letsa & Ankomah","Susan-Barbara Boye"]
[null,null,"Nana Ama Asare"]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","Ghana"]
["Key Legislation Overview"]
["1. What is the key legislation?","The 1992 Constitution of the Republic of Ghana guarantees the privacy of an individual’s correspondence and communication under \nArticle 18 (2). The \nData Protection Act, 2012 (Act 843) (\"\nDPA\") is the key legislation that governs the processing of personal data in Ghana. The \nDPA was enacted to give meaning to \nArticle 18 (2) in order to protect the privacy and data of an individual, especially in a digital society.\n"]
["2. What are the key decisions applying that legislation?"]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?"]
["2. How is the defined data protected?"]
["3. Who is subject to privacy obligations?","Under the \nDPA, data controllers and data processors are subject to privacy obligations. A data controller is a natural or legal person who determines the purposes and manner in which personal data is processed, either alone or in collaboration with others. A data processor is anyone who processes data on behalf of a data controller and is not an employee of the data controller.\n"]
["4. How is “data processing” defined?"]
["5. What are the principles applicable to personal data processing?","The principles of accountability, lawfulness of processing, specification of purpose, compatibility of further processing with purpose of collection, quality of information, openness, data security safeguards and data subject participation apply to the processing of personal data.\n"]
["6. How is the processing of personal data regulated?","Under the \nDPA, personal data must be processed without infringing on the data subject’s privacy rights and in a lawful and reasonable manner.\nConsent and justification for processing dataProcessing of personal data must be based on the consent of the data subject unless the processing is justified by another legal basis. Under the \nDPA, other legal bases include necessary for a contract to which the data subject is a party, authorized by law or statutory duty, and for the legitimate interest of the data subject or the data controller.\nProcessing of special personal dataThe \nDPA specifically provides for processing data relating to a child and special personal data. Special personal data may only be processed with the consent of the data subject or where processing is necessary. The \nDPA sets out the grounds for which data processing is considered necessary.\nExemptionsThe \nDPA stipulates the circumstances under which the processing of personal data is exempt from (i) the provisions of the \nDPA, (ii) the data protection principles, and (iii) the provisions on non-disclosure.\n"]
["7. How are storage, security and retention of personal data regulated?","SecurityA data controller must secure the integrity of personal data by adopting appropriate, reasonable, technical and organizational measures to prevent loss of, damage to, unauthorized destruction, unlawful access to or unauthorized processing of personal data. Additionally, a data controller must take reasonable measures to identify reasonably foreseeable external and internal risks to personal data, provide safeguards against risks identified, regularly verify that the safeguards are effectively implemented, and ensure that the safeguards are continually updated in response to new risks or deficiencies.\nA data controller must ensure that a data processor who processes personal data for the data controller establishes and complies with security measures in the \nDPA.\nRetentionPersonal data must not be retained for a period longer than is necessary for achieving the purpose of its collection, unless the retention of the data is required by law, by virtue of a contract between the contracting parties, or with the consent of the data subject. This requirement does not apply to personal data records kept for historical, statistical or research purposes. When the retention period expires, the data controller must destroy or delete the record of personal data or de-identify the record. The destruction or deletion of personal data must be done in a way that prevents its reconstruction in an intelligible form.\nStorageThe \nDPA does not have any storage-related provisions other than those relating to security and retention. Although not specifically mentioned, the definition of processing under the \nDPA infers the storage of the data as processing includes collection, organization, consultation and retrieval.\n"]
["8. What are the data subjects' rights under the data legislation?"," The data subject rights under the DPA are: \n \n the right to be informed about data collection and its intended purpose; \n the right to be notified of an unauthorized access or acquisition of personal data, subject to a request by the Data Protection Commission or security agencies to delay the notification; \n the right to know whether a data controller has the personal data of the data subject, the description of the data held and whether a third party has had access to the data; \n the right to request that a data controller correct or delete personal data of the data subject under the data controller’s control that is inaccurate, irrelevant, excessive, incomplete or unlawfully obtained; \n the right to request that a data controller delete or destroy personal data of the data subject held by the data controller which the data controller no longer has the authority to retain; \n the right to object to the processing of the data subject’s personal data; \n the right not to be subjected to a decision based solely on automated processing; \n the right to require a data controller to cease or not to start processing for a specified purpose or in a specified manner personal data which causes or is likely to cause unwarranted damage or distress to the data subject; \n the right to require a data controller not to process personal data for direct marketing purposes; and \n the right to receive compensation for damage or distress caused by a data controller’s contravention of the DPA ’s requirements. \n "]
["9. What are the consent requirements for data subjects?"]
["10. How is authorization for use of data handled?"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","There are no restrictions on cross-border data transfers. Processing of personal data originating entirely or partially from Ghana must be done in accordance with the provisions of the \nDPA. A data controller must obtain the prior consent of the data subject for the processing of the personal data which includes the transfer of data. A data controller or processor must ensure that data relating to foreign data subjects is processed in accordance with the data protection legislation of the foreign jurisdiction of that subject.\n"]
["12. How are data \"incidents\" and \"breaches\" defined?"]
["13. Are there any notification requirements for incidents and/or data breaches?","Under the \nDPA, a data controller or a third party processing the data must notify the Commission and the data subject if there is a reasonable basis to believe that the data being processed has been accessed or acquired by an unauthorized person. The notification must be done as soon as reasonably practicable after discovering the breach. The notification to the data subject may be delayed if the Data Protection Commission and security agencies notify the data controller to delay the notification because of a criminal investigation.\nThe notification to a data subject may be communicated by registered mail to the data subject’s last known residential or postal address or email address, on the data controller’s or the third-party processor’s website, or by publication in the media. A notification must provide sufficient information to allow the data subject to take protective measures against the consequences of the data breach. The notification must include if known to the data controller, the identity of the unauthorized person who may have accessed or acquired the personal data.\n"]
["14. Who is/are the privacy regulator(s)?","The Data Protection Commission is the body established under the DPA to implement and ensure compliance with the provisions of the \nDPA.\n"]
["15. What are the consequences of a data breach?","The \nDPA provides penalties for specific data protection breaches and a general penalty for offenses for which specific penalties are not stated. The general penalty for an offense under the \nDPA is a fine of not more than GHS 60,000 or a term of imprisonment of not more than ten years, or both.\nNon-compliance with notices from the DPCUnder the \nDPA, a person who fails to comply with an enforcement or information notice commits an offense and is liable to a fine of not more than GHS 1,800 or a term of imprisonment of not more than one (1) year, or both. The \nDPA explains the situations in which an enforcement or information notice may be issued.\nCompensationA person who suffers damage or distress as a result of a data controller's breach of the provisions of the \nDPA is entitled to compensation from the data controller.\n"]
["16. How is electronic marketing regulated?","Electronic marketing requires prior consent and the ability to opt-out.\nThe\n DPA prohibits a data controller from providing, using or procuring information related to a data subject for direct marketing without the prior written consent of the data subject. A data subject has the right to require a data controller not to process personal data of that data subject for the purposes of direct marketing. Direct marketing is communication by whatever means of any advertising or marketing material that is directed to particular individuals.\nUnder the \nElectronic Transactions Act, 2008 (\"Act 772\"), a person may not send unsolicited electronic communications to a consumer without first obtaining the consumer’s prior consent. In addition, the sender must provide the consumer with (a) the option to cancel the consumer's subscription to the sender's mailing list, and (b) the identifying particulars of the source from which the sender obtained the consumer's personal information at the consumer's request.\n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?"]
["19.\tWhat are the record-keeping and documentation obligations?"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?"]
["23.\tWhat are the ongoing compliance and audit requirements?"]
["24. Are there any recent developments or expected reforms?","The Data Protection Commission is developing a legislative instrument to be used in conjunction with the \nDPA.\n"]