Ghana

Data Protection Act, 2012 (Act 843) section 45(1) applies the Act where the controller is established in Ghana and processes there, or is not established in Ghana but uses equipment or a data processor carrying on business in Ghana, or where the processing concerns information originating partly or wholly from Ghana. Section 45(3) defines 'established' broadly, down to anyone maintaining an office, branch or agency through which business is carried out. Section 45(4) carves out data that merely transits Ghana. Section 45(2) requires a controller not incorporated in Ghana to register as an external company; the Commission's own registration guidance asks external entities for 'the name and address of the company's representatives'. Note there is no separate 'data protection representative' office as in Europe - the requirement is a corporate registration one.

SECTOR BY SECTOR, checked 18 August 2026. BANKING, PAYMENTS, LENDING, CREDIT REFERENCE, FOREIGN EXCHANGE AND VIRTUAL ASSET FIRMS - conditional. The Bank of Ghana's Cyber and Information Security Directive of March 2026 applies to institutions licensed under the Banks and Specialised Deposit-Taking Institutions Act 2016 (Act 930), the Development Finance Institutions Act 2020 (Act 1032), the Non-Bank Financial Institutions Act 2008 (Act 774), the Payment Systems and Services Act 2019 (Act 987), the Credit Reporting Act 2007 (Act 726), the Foreign Exchange Act 2006 (Act 732) and the Virtual Service Providers Act 2025 (Act 1154). It requires prior Bank of Ghana approval to move to cloud services, requires contracts with managed security providers to state that data must remain within jurisdictions approved by the Bank of Ghana, and requires cloud readiness checks to confirm approvals for cross-border transfers. It does not say the data must physically stay in Ghana. TELECOMS AND ONLINE SERVICE PROVIDERS - a narrow hard wall. Cybersecurity Act 2020 (Act 1038) section 76(5) forbids interception equipment being installed, managed or monitored in a foreign country, or remotely accessible from abroad for maintenance. GOVERNMENT - the National Information Technology Agency runs a government cloud and the Ghana National Data Centre for public sector agencies and describes the cloud as hosting sensitive citizen data; we did not find a binding instrument forbidding foreign hosting of government data, so treat this as procurement practice rather than law. HEALTH, INSURANCE, SECURITIES, EDUCATION, GAMBLING AND MAPPING - no localisation or transfer rule found, checked 18 August 2026, medium confidence. The Gaming Commission's published licence conditions turn on ownership and due diligence, not server location. CRITICAL INFRASTRUCTURE - thirteen sectors are designated critical, but the directive governing them imposes security and reporting duties, not storage location.

Ghana is best described as unrestricted at the national layer. There is no adequacy machinery, no standard contractual clauses and no binding corporate rules regime. The registration form under section 47(1)(g) of Act 843 asks for 'the name or description of the country to which the applicant may transfer the data', which makes the destination a disclosure item rather than a permission. Section 30(4) puts the burden on the Ghanaian controller: where a processor is not domiciled in Ghana, the controller must ensure the processor complies with Ghanaian law. Section 18(2) runs in the opposite direction and is often misread - it deals with data sent INTO Ghana for processing, and requires the Ghanaian processor to respect the foreign country's rules. In the regulated financial sector the model becomes case-by-case: prior Bank of Ghana approval to transition to cloud, and jurisdictions approved by the Bank of Ghana. The draft Data Protection Bill published for comment in November 2025 would replace all of this with a consent-plus-approval regime and some hard localisation; it is not law.

DATA PROTECTION COMMISSION - operational but quiet. Established by Act 843, based in Accra, Executive Director Dr Arnold Kavaarpuo as at the Commission's own January 2026 Data Protection Week launch. Its published output is registration, an amnesty for late registrants, compliance guidance, accreditation of practitioners and awareness campaigns. Its news page carried only a handful of items when checked on 18 August 2026 and none of them announced an enforcement outcome. Act 843 gives it enforcement notices and criminal offences rather than European-style administrative fines, so 'no published fine' is partly a design feature. Its real leverage is indirect: the Bank of Ghana asks fintech licence applicants for a Data Protection Certificate, so registration becomes a gate to doing business. CYBER SECURITY AUTHORITY - active. Licensing of cybersecurity service providers began 1 March 2023; the acting Director-General has publicly stated the Authority is 'actively enforcing its licensing and accreditation framework' and that only licensed providers and accredited professionals may operate. It publishes advisories, runs the national computer emergency response team, and reported in June 2026 that its intelligence led to an arrest in an international cyber fraud investigation. BANK OF GHANA - active, and the most demanding supervisor in practice. Overall rating: waking, because the privacy regulator specifically has not yet shown enforcement outcomes.

CEILING. Act 843 section 24(1) forbids retention longer than necessary for the purpose, unless retention is required or authorised by law, is reasonably necessary for a lawful purpose, is required by contract, or the person consents. Section 24(5) then requires destruction, deletion or de-identification at the end of the period, and section 24(6) requires destruction 'in a manner that prevents its reconstruction in an intelligible form' - which rules out simply marking a record inactive. FLOOR. Cybersecurity Act 2020 (Act 1038) section 77(1) requires a service provider to retain subscriber information for at least six years, traffic data for twelve months and relevant content data for twelve months, with the High Court able to extend the twelve-month periods on an ex parte application. The definition of 'service provider' in Act 1038 is wide enough on its face to include entities that process or store computer data on behalf of a communication service or its users, so cloud and hosting businesses should not assume this is a telecoms-only rule. In the regulated financial sector, the Bank of Ghana's March 2026 directive requires logs and audit trails from artificial intelligence and machine learning systems to be kept securely for at least seven years. CONFLICT RESOLUTION. The carve-out in section 24(1)(a) - 'required or authorised by law' - is what reconciles the two, so the statutory minimum wins.

CLOCK ONE, 24 hours. Cybersecurity Act 2020 (Act 1038) section 47(5) requires 'a person in charge of an institution' to report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team, within not more than 24 hours after detection. Failure attracts an administrative penalty under the Act's Second Schedule. Reporting routes are published by the Cyber Security Authority, including a short code and an incident form. CLOCK TWO, no fixed deadline. Act 843 section 31 requires notification to both the Data Protection Commission and the affected individual, 'as soon as reasonably practicable after the discovery of the unauthorised access or acquisition'. Notification to individuals may be delayed if the Commission or the security agencies say it would impede a criminal investigation. CLOCK THREE, 72 hours. The Cyber Security Authority's directive on critical information infrastructure requires designated owners to disclose vulnerabilities found in internal or external audits within 72 hours, and to report incidents within 24 hours. FOURTH, sector. Regulated financial institutions must notify the Bank of Ghana immediately for defined events, including customer information leaking outside the institution, plus a monthly incident report by the 15th and a nil return in a quiet month.

(1) REGISTRATION IS A PRECONDITION. Act 843 section 53 states plainly that an unregistered controller shall not process personal data. Registration is renewable every two years, and the Bank of Ghana asks fintech applicants for a Data Protection Certificate, so lapsing has commercial consequences well beyond the regulator. (2) CRIMINAL, NOT ADMINISTRATIVE. Act 843 penalties are expressed as penalty units and imprisonment on summary conviction - up to two years for failing to register, up to five years for unlawful disclosure or selling personal data, and a general penalty of up to ten years. Fines are set in 'penalty units' whose current cash value we could not confirm from an official source; historically the unit has been small, so the prison exposure and the reputational damage matter far more than the money. (3) CYBERSECURITY WORK NEEDS A LICENCE. Under Act 1038 anyone providing penetration testing, digital forensics, managed security services, cybersecurity governance and risk work, or cybersecurity training for reward needs a licence; licences last two years and cannot be transferred. The Authority says it is actively enforcing this. (4) PERSONAL LIABILITY FOR EQUIPMENT SITED ABROAD. Act 1038 section 76 forbids interception equipment being installed, managed or monitored abroad, and section 76(10) deems the chief executive, deputy chief executive, chief legal officer and the officer in charge of finance to have also committed the offence. (5) THE DATA PROTECTION SUPERVISOR MISMATCH. The Act says a controller 'may' appoint a certified data protection supervisor, while the Commission's compliance guidance tells medium and large controllers to appoint a full-time in-house supervisor. Treat the guidance as the operative expectation. (6) CHILDREN. Act 843 treats the data of 'a child who is under parental control in accordance with the law' as special personal data, but sets no numeric age of digital consent - so there is no equivalent of the European thirteen-to-sixteen band to design to.

THE DRAFT BILL. Clause 96 of the Data Protection Bill, 2025 would require localisation for data critical to national defence, security and intelligence; data in national identity and civil registration systems including voter databases; and children's data, biometric data, health records and genetic data. Clause 96(4) would allow transfer abroad only with written, free, explicit and informed consent plus one of a short list of necessity grounds, and clause 96(4)(c) would require the regulator's authorisation where large-scale data is involved. Clause 97 would require regulator approval before processing special personal data outside Ghana, allow the regulator to prohibit or suspend a transfer, and require a transfer impact assessment for large-scale high-risk processing. Clause 96(1) also contains a general 'make reasonable efforts to localise' duty. We checked the Parliament of Ghana's list of bills laid on 18 August 2026 and found no Data Protection Bill, so this remains a consultation draft. DORMANT SWITCHES, which matter more than the bill. First, the Cyber Security Authority may issue a directive to a critical infrastructure owner 'without any notice' and the owner must comply. Second, the Bank of Ghana controls which jurisdictions financial data may sit in through approval, not through published rules, so the set of acceptable countries can change by supervisory letter. Third, the High Court can extend telecom and service provider content and traffic retention beyond twelve months on an application made without the provider present.