Ghana Data Protection Bill, 2025 - Draft

Would cover specified domestic and overseas processing, foreign targeting/profiling and local equipment/processor connections; some foreign controllers would designate a representative. Would apply to the State.

Would establish principles, retention, DPIAs, legitimate-interest assessments, protection by design/default, processor safeguards and breach notice. Clause 51 includes a proposed 72-hour Authority notice requirement.

Would require explainability, contestability, human oversight and specified prelaunch DPIAs. Rights cover election-campaign processing and automated decisions. Child in the draft is under 18. Clause 53’s “bi-annually” audit wording is not converted into an unambiguous frequency.

Would introduce registration, DPO and service-provider accreditation rules. Clauses 96-97 combine localisation qualifications, sensitive-data approval and transfer conditions; consent is not simplified into a freely interchangeable transfer basis.

Would provide exemptions, repeal/savings for Act 843 and transition. Clause 125 would require a Ministerial Gazette commencement date. Clause 93(2)’s review cross-reference conflicts with the draft numbering and is not silently corrected.