Ghana · Compliance
Ghana Data Protection Act, 2012 (Act 843) compliance in Ghana
Achieve Ghana Data Protection Act, 2012 (Act 843) compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Lagos office team
- Effivity software included
- Academy training included
Who asks for Ghana Data Protection Act, 2012 (Act 843) in Ghana
Clients include
Ghana Data Protection Act, 2012 (Act 843) compliance in Ghana at a glance
Data Protection Act, 2012 (Act 843) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Ghana ask for evidence that you meet it.
Ghana's Data Protection Act, 2012 (Act 843) has been in effect since October 2012 and is enforced by the Data Protection Commission, which keeps a register of data controllers and processors. The Act reaches controllers established in Ghana, outside controllers who use equipment or processors here and information originating from Ghana, and it turns on accountability, lawful and minimal processing, clear purpose, security safeguards, written processor contracts, prompt notification of security compromises and rights of access and correction. Registration lasts two years and renewal asks for a compliance report. A draft Data Protection Bill, 2025 is out for comment but is not law. There is no certificate of compliance; registration is a listing, and ISO/IEC 27701 or ISO/IEC 27001 certification is optional support. Data mapping, notices, processor contracts, impact assessments and Data Protection Supervisor support are delivered from Sterling's Lagos office, with Effivity keeping the evidence current and Sterling Academy included.
Who needs Ghana Data Protection Act, 2012 (Act 843) in Ghana, and what happens without it
These are the organisations in Ghana that most often need to show Ghana Data Protection Act, 2012 (Act 843).
- Any organisation processing personal data in or from GhanaThe Act applies to controllers established in Ghana, to outside controllers using equipment or processors carrying on business in Ghana, and to data originating partly or wholly from Ghana.
- Data controllers and processors that must registerRegistration is mandatory, including for foreign companies processing personal data in Ghana, and the certificate has to be renewed with a compliance report.
- BPO and shared-service firms processing overseas clients' dataThe Act requires processing of foreign data subjects' data to follow the law of their jurisdiction, so two regimes apply at once.
- Banks, fintechs and payment firmsCustomer data volumes are high, and the Act's security and breach duties sit beside the Bank of Ghana directive.
- Hospitals, schools and employers holding sensitive dataHealth, belief, union and similar data is special personal data, which brings tighter conditions and a greater duty of care.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkGhana Data Protection Act, 2012 (Act 843) requirements in Ghana
Strip away the vocabulary and Ghana's Data Protection Act requires a business to comply in six areas of personal data handling.
In Ghana these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Ghana Data Protection Act, 2012 (Act 843) explained →
How to achieve Ghana Data Protection Act, 2012 (Act 843) compliance in Ghana
One team from the Lagos office carries the work from scoping to sign-off. Clients across Ghana are served from Sterling's Lagos office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Ghana Data Protection Act, 2012 (Act 843) and the Ghanaian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Ghana Data Protection Act, 2012 (Act 843) compliance take in Ghana?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Ghana these are the factors that set the timeline.
- Number of processing activities, systems and processors to map
- Registration status and the compliance report due at renewal
- Appointment and training of a Data Protection Supervisor
- Cross-border processing of overseas clients' data to reconcile
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Ghana Data Protection Act, 2012 (Act 843) compliance cost in Ghana?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Ghana these factors move both.
- Number of legal entities, units and data subjects in scope
- Volume and sensitivity of data, including health and children's data
- Review of processor and client agreements
- Registration fees set by the Commission's schedule, and security remediation, quoted separately
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Ghana Data Protection Act, 2012 (Act 843) consultants and assessors in Ghana
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Ghana Data Protection Act, 2012 (Act 843) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Ghana are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Ghana Data Protection Act, 2012 (Act 843) in Ghana (4)
| Instrument | How it treats the standard |
|---|---|
| Data Protection Act, 2012 (Act 843) | The instrument itself Principles, consent and justification, registration, security measures, processor contracts, security compromise notification, data subject rights and enforcement, regulated by the Data Protection Commission. |
| Data Protection Commission — registration, renewal and compliance guidance | Regulator scheme A Certificate of Registration valid for two years, a compliance report for renewal, recommendations on Data Protection Supervisors and accredited institutions, and due diligence searches on controllers. |
| Draft Data Protection Bill, 2025 | Reform signal A draft published for comment that would replace the Commission with a Data Protection Authority; it is not law and does not change today's obligations. |
| Cybersecurity Act, 2020 (Act 1038) | Related Separate duties on cybersecurity service providers and critical information infrastructure owners, with their own incident reporting. |
Accreditation, audit language and remote audits in Ghana
Compliance, not certification: the Act creates no certificate of conformity. The Data Protection Commission issues a Certificate of Registration, which records that you are on the register and is not an assessment of your practices. Evidence is your own records, privacy notices, processor contracts, impact assessments, breach log and the compliance report the Commission asks for at renewal. ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body is an optional way to evidence the systems behind your answers. Sterling is not the regulator and does not certify, accredit, attest or validate. Edition and transition details: Ghana Data Protection Act, 2012 (Act 843) hub →
Audit language
English is the usual audit and document language; agree it with the certification body at application, and say early if interviews will run in a local language.
Remote and on-site
Data mapping workshops, notice reviews and contract work can be done on-site or remotely; registration and renewal run through the Commission's online portal.
Ghana Data Protection Act, 2012 (Act 843) in Ghana: questions clients ask
Is there a certificate for the Data Protection Act in Ghana?
No. The Act creates no certificate of conformity. What the Commission issues is a Certificate of Registration, valid for two years, which shows you are on its register and says nothing about the quality of your practices. You show compliance through notices, contracts, security measures, a breach log and the compliance report for renewal. Confirm your own position with counsel or the Commission.
Who has to register with the Data Protection Commission?
Data controllers and processors, including foreign companies processing personal data in Ghana, as the Commission's registration page lists them, with the Act requiring a controller who intends to process personal data to register. Fees depend on the size and sector of the entity under the Commission's schedule. Check the Commission's current guidance on where your organisation sits before you apply.
Does the Act apply to a company based outside Ghana?
It can. The Act reaches a controller outside Ghana that uses equipment or a processor carrying on business in Ghana, and information originating partly or wholly from Ghana, while data that originates externally and merely transits is outside it. A controller not incorporated in Ghana must register as an external company. Take advice from counsel on how the Act and your home law fit together.
How soon must a security breach be reported in Ghana?
As soon as reasonably practicable after discovery. Where there are reasonable grounds to believe an unauthorised person has accessed or acquired personal data, the controller, or a third party processing under its authority, must notify the Commission and the data subject, and may delay telling the data subject if the Commission or security agencies say it would impede an investigation. Keep a breach log and take advice on each incident.
More on Ghana Data Protection Act, 2012 (Act 843) for Ghanaian organisations
Other standards Ghanaian businesses ask Sterling for
Organisations in Ghana often combine Ghana Data Protection Act, 2012 (Act 843) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Lagos office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2012 (Act 843) — dpc.gov.gh (accessed 11 Oct 2026)
- Data Protection Commission — registration, renewal and compliance guidance — dpc.gov.gh (accessed 11 Oct 2026)
- Draft Data Protection Bill, 2025 — dpc.gov.gh (accessed 11 Oct 2026)
- Cybersecurity Act, 2020 (Act 1038) — dpc.gov.gh; csa.gov.gh (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice