Ghana

Section 45(1) of the Data Protection Act, 2012 (Act 843) applies the Act in three cases. One, your company is established in Ghana and handles data there. Two, your company is not established in Ghana but uses equipment or a data supplier carrying on business in Ghana. Three, the data comes partly or wholly from Ghana. Section 45(3) defines 'established' broadly. It goes down to anyone keeping an office, branch or agency through which business is carried out. Section 45(4) leaves out data that merely passes through Ghana. Section 45(2) requires a company not incorporated in Ghana to register as an external company. The Commission's own registration guidance asks external companies for 'the name and address of the company's representatives'. Note there is no separate data protection representative role as in Europe. This is a company registration requirement.

INDUSTRY BY INDUSTRY, checked 18 August 2026. BANKING, PAYMENTS, LENDING, CREDIT REFERENCE, FOREIGN EXCHANGE AND VIRTUAL ASSET FIRMS - conditional. The Bank of Ghana's Cyber and Information Security Directive of March 2026 applies to institutions licensed under seven laws. Those laws are the Banks and Specialised Deposit-Taking Institutions Act 2016 (Act 930). The Development Finance Institutions Act 2020 (Act 1032). The Non-Bank Financial Institutions Act 2008 (Act 774). The Payment Systems and Services Act 2019 (Act 987). The Credit Reporting Act 2007 (Act 726). The Foreign Exchange Act 2006 (Act 732). And the Virtual Service Providers Act 2025 (Act 1154). You need the Bank of Ghana's approval before you move to cloud services. Your contracts with managed security providers must say data stays within countries the Bank of Ghana has approved. Cloud readiness checks must confirm approvals for transfers abroad. The directive does not say the data must physically stay in Ghana. TELECOMS AND ONLINE SERVICE PROVIDERS - a narrow must-stay-here rule. Section 76(5) of the Cybersecurity Act 2020 (Act 1038) forbids interception equipment being installed, managed or monitored in a foreign country. It also forbids remote access from abroad for maintenance. GOVERNMENT - the National Information Technology Agency runs a government cloud and the Ghana National Data Centre for public sector agencies. It describes the cloud as hosting sensitive citizen data. We found no binding law forbidding foreign hosting of government data. Treat this as purchasing practice rather than law. HEALTH, INSURANCE, SECURITIES, EDUCATION, GAMBLING AND MAPPING - we found no rule on storage location or transfers, checked 18 August 2026, medium confidence. The Gaming Commission's published licence conditions turn on ownership and background checks, not server location. CRITICAL INFRASTRUCTURE - thirteen industries are designated critical. The directive covering them sets security and reporting duties, not storage location.

At national level Ghana is best described as unrestricted. There is no machinery for approving countries. There are no standard contract clauses and no binding corporate rules. The registration form under section 47(1)(g) of Act 843 asks for 'the name or description of the country to which the applicant may transfer the data'. That makes the destination something you disclose, not something you need permission for. Section 30(4) puts the burden on the Ghanaian company. Where your supplier is not based in Ghana, you must make sure that supplier follows Ghanaian law. Section 18(2) runs the other way and is often misread. It deals with data sent INTO Ghana to be handled. It requires the Ghanaian supplier to respect the foreign country's rules. In regulated financial services the model becomes case by case. You need the Bank of Ghana's prior approval to move to cloud, and the countries must be ones the Bank of Ghana has approved. The draft Data Protection Bill published for comment in November 2025 would replace all of this. It would bring in consent plus approval, and force some data to stay in Ghana. It is not law.

DATA PROTECTION COMMISSION - working but quiet. Established by Act 843 and based in Accra. Its Executive Director is Dr Arnold Kavaarpuo, as at the Commission's own January 2026 Data Protection Week launch. Its published output is registration, an amnesty for late registrants, compliance guidance, accreditation of practitioners and awareness campaigns. Its news page carried only a handful of items when checked on 18 August 2026. None of them announced an enforcement outcome. Act 843 gives it enforcement notices and criminal offences, not European-style administrative fines. So 'no published fine' is partly by design. Its real leverage is indirect. The Bank of Ghana asks fintech licence applicants for a Data Protection Certificate. So registration becomes a gate to doing business. CYBER SECURITY AUTHORITY - active. Licensing of cybersecurity service providers began 1 March 2023. The acting Director-General has publicly said the Authority is actively enforcing its licensing and accreditation rules. Only licensed providers and accredited professionals may operate. It publishes advisories and runs the national computer emergency response team. In June 2026 it reported that its intelligence led to an arrest in an international cyber fraud investigation. BANK OF GHANA - active, and the most demanding supervisor of the three. Overall rating: waking. That is because the privacy regulator in particular has not yet shown enforcement outcomes.

MAXIMUM. Section 24(1) of Act 843 forbids keeping data longer than the purpose needs. There are exceptions. They cover where a law requires or allows it. They cover where it is reasonably necessary for a lawful purpose. They also cover where a contract requires it, or where the person consents. Section 24(5) then requires destruction, deletion or de-identification at the end of the period. Section 24(6) requires destruction 'in a manner that prevents its reconstruction in an intelligible form'. So you cannot just mark a record inactive. MINIMUMS. Section 77(1) of the Cybersecurity Act 2020 (Act 1038) requires a service provider to keep subscriber information for at least six years. It requires traffic data for twelve months and relevant content data for twelve months. The High Court can extend the twelve-month periods on an application made without you present. The definition of 'service provider' in Act 1038 is wide on its face. It can include companies that handle or store computer data for a communication service or its users. So cloud and hosting businesses should not assume this is a telecoms-only rule. In regulated financial services, the Bank of Ghana's March 2026 directive covers artificial intelligence and machine learning systems. Their logs and audit trails must be kept securely for at least seven years. WHICH WINS. Section 24(1)(a) excludes retention 'required or authorised by law'. That is what reconciles the two, so the legal minimum wins.

CLOCK ONE, 24 hours. Section 47(5) of the Cybersecurity Act 2020 (Act 1038) covers 'a person in charge of an institution'. They must report a cybersecurity incident within no more than 24 hours after detection. You report to the Computer Emergency Response Team for your industry, or to the National Computer Emergency Response Team. Failure attracts an administrative penalty under the Act's Second Schedule. The Cyber Security Authority publishes the reporting routes, including a short code and an incident form. CLOCK TWO, no fixed deadline. Section 31 of Act 843 requires you to notify both the Data Protection Commission and the affected person. The wording is 'as soon as reasonably practicable after the discovery of the unauthorised access or acquisition'. You may delay telling individuals if the Commission or the security agencies say it would get in the way of a criminal investigation. CLOCK THREE, 72 hours. The Cyber Security Authority's directive on critical information infrastructure requires designated owners to disclose weaknesses found in internal or external audits within 72 hours. They must report incidents within 24 hours. FOURTH, your industry. Regulated financial institutions must notify the Bank of Ghana immediately for defined events. Those include customer information leaking outside the institution. They must also file a monthly incident report by the 15th, and a nil return in a quiet month.

(1) REGISTRATION COMES FIRST. Section 53 of Act 843 says plainly that an unregistered company shall not handle personal data. You renew registration every two years. The Bank of Ghana asks fintech applicants for a Data Protection Certificate. So letting registration lapse has commercial consequences well beyond the regulator. (2) CRIMINAL, NOT ADMINISTRATIVE. Act 843 penalties are expressed as penalty units and imprisonment on summary conviction. That is up to two years for failing to register. It is up to five years for unlawful disclosure or for selling personal data. There is a general penalty of up to ten years. Fines are set in 'penalty units'. We could not confirm the current cash value of a unit from an official source. Historically the unit has been small. So the prison exposure and the reputational damage matter far more than the money. (3) CYBERSECURITY WORK NEEDS A LICENCE. Under Act 1038 you need a licence to sell certain services for reward. Those are penetration testing, digital forensics, managed security services, cybersecurity governance and risk work, and cybersecurity training. Licences last two years and cannot be transferred. The Authority says it is actively enforcing this. (4) PERSONAL LIABILITY FOR EQUIPMENT SITED ABROAD. Section 76 of Act 1038 forbids interception equipment being installed, managed or monitored abroad. Section 76(10) treats four named officers as having also committed the offence. They are the chief executive, the deputy chief executive, the chief legal officer and the officer in charge of finance. (5) THE DATA PROTECTION SUPERVISOR MISMATCH. The Act says a company 'may' appoint a certified data protection supervisor. The Commission's compliance guidance tells medium and large companies to appoint a full-time in-house supervisor. Treat the guidance as what is actually expected. (6) CHILDREN. Act 843 treats the data of 'a child who is under parental control in accordance with the law' as special personal data. It sets no numeric age of digital consent. So there is no equivalent of the European thirteen-to-sixteen band to design to.

THE DRAFT BILL. Clause 96 of the Data Protection Bill, 2025 would require some data to stay in Ghana. That covers data critical to national defence, security and intelligence. It also covers data in national identity and civil registration systems, including voter databases. And it covers children's data, biometric data, health records and genetic data. Clause 96(4) would allow a transfer abroad only with written, free, explicit and informed consent, plus one of a short list of necessity grounds. Clause 96(4)(c) would require the regulator's authorisation where large amounts of data are involved. Clause 97 would require regulator approval before special personal data is handled outside Ghana. It would let the regulator ban or suspend a transfer. It would require a transfer impact assessment for large-scale, high-risk work. Clause 96(1) also contains a general duty to make reasonable efforts to keep data in Ghana. We checked the Parliament of Ghana's list of bills laid on 18 August 2026 and found no Data Protection Bill. So this remains a consultation draft. THINGS THAT CAN CHANGE WITHOUT WARNING, which matter more than the bill. First, the Cyber Security Authority may issue a directive to a critical infrastructure owner 'without any notice', and the owner must comply. Second, the Bank of Ghana controls which countries financial data may sit in through approval, not through published rules. So the set of acceptable countries can change by supervisory letter. Third, the High Court can extend telecom and service provider content and traffic retention beyond twelve months. That is on an application made without the provider present.