← Global Privacy Laws Research Library
Act 843
Data Protection Act, 2012
Ghana Data Protection Act, 2012 (Act 843)
Prepared by Shubhank Suman · Last reviewed
Enacted text; separate commencement notice not included
- Legal character
- National statute
- Region
- Africa
- Assent
- 10 May 2012
- Published
- 18 May 2012 (Gazette notification)
What it covers
Establishes the Data Protection Commission and regulates personal-data processing through minimality, lawful justification, purpose, notice, retention, data quality, security, registration and individual rights. Includes special personal data, direct marketing and automated decision-taking.
Why it matters
This is the enacted Act 843 source, distinct from the library’s proposed 2025 bill. A proposed repeal in a draft does not establish that this Act has been repealed.
Refer to it when
Research Ghanaian processing principles, controller registration, access/correction, special personal data, direct marketing, automated decisions or security compromises.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
Section 41 protects against specified automated decision-taking; personal-data AI processing also engages principles and security. Not a general AI framework.
Privacy
VERY HIGH
Comprehensive processing principles, rights and registration.
Cybersecurity
HIGH
Security and compromise notification under sections 28-31.
Applicability
Read section 45’s establishment/equipment connections and exclusions, section 91 on State application and sections 60-74 exemptions. Section 18(2) separately addresses foreign data subjects; this is not simplified into a universal GDPR-style transfer rule.
Read first
Sections 45, 91 and exemptions → 17-31 → 32-44 → 46-58 → 75-80 → 99.
Provisions / sections covered
Sections 1-16 - Commission
Establishment, functions, governance and finances of the Data Protection Commission.
Sections 17-27 - Processing principles
Minimality, consent and other justifications, collection, purpose, notice, retention, compatible further processing, data quality and controller registration.
Sections 28-35 - Security and access
Security measures, processor safeguards, notification of security compromises, access and correction. Section 31 uses “as soon as reasonably practicable”, not a universal 72-hour deadline.
Sections 37-44 - Special data and rights
Special personal data and exceptions; prevention of processing and direct marketing; section 41 automated decision-taking; compensation and rectification/blocking/erasure.
Sections 45-80 and 99 - Scope, registration and enforcement
Read territorial/application rules, registration, exemptions and enforcement separately. Section 99 requires the Minister to specify commencement by Gazette publication.
Subject-matter tags
- Consent
- Data subject rights
- Erasure and deletion
- Automated decision-making
- Security
- Controller and processor
- Direct marketing
- Retention
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.