Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
Réglementations › Reste du monde › Ghana
DPA (Ghana)
Data Protection Act, 2012 (loi 843, Ghana)
QuandEn vigueur depuis le 16 octobre 2012
Qui en assure l’applicationCommission de protection des données (DPC)
À qui elle s’appliqueResponsables du traitement établis au Ghana ou y effectuant un traitement de données.
Informer le régulateurNotifier la Commission dès que raisonnablement possible après la découverte
DPO requisLa loi permet aux responsables du traitement de désigner un superviseur certifié de la protection des données
EnregistrementChaque responsable du traitement doit s’enregistrer auprès de la Commission, payer une redevance et renouveler son enregistrement tous les deux ans
Transferts à l’étrangerAucune restriction générale des transferts
Délai de réponse aux demandes40 jours pour les demandes d’accès
Amende maximaleSanction générale jusqu’à 5,000 unités de pénalité (environ GHS 60,000) et/ou 10 ans d’emprisonnement
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Portée et base légale
Portée extraterritoriale
3
Applies to controllers in Ghana, foreign controllers using equipment or processors in Ghana, and processing of information originating in Ghana.s.45(1) · source ↗
s.45(1)(c) on data originating in Ghana is broad; interpretation not tested.
Base légale
1
Prior consent or listed grounds, including contract, legal obligation, and legitimate interests of the controller or a third party.s.20(1) · source ↗
Consentement
1
Consent is not defined; prior consent is the default and written consent is required for direct marketing.s.20(1); s.40(1); s.94(1)(b) · source ↗
Données sensibles
2
Special personal data (health, religion, ethnicity, sexual life and others) is prohibited unless consent or a listed exception applies.s.37 · source ↗
Enfants
3
Age 18 (Children's Act). Data about a child under parental control is treated as special personal data.s.37(1)(a) · source ↗
Act 843 does not define child; 18 from the Children's Act 1998 (Act 560), not re-read.
Droits des personnes
Droits
2
Access, correction and deletion, the right to prevent processing, direct marketing opt-out, and rights against solely automated decisions.ss.33, 35, 39-41 · source ↗
No portability or restriction right.
Délai de réponse aux demandes
1
40 days for access requests; 21 days to respond to notices to prevent processing.s.35(10); s.39(2) · source ↗
Marketing
3
Direct marketing requires the data subject's prior written consent, and data subjects may later require it to stop.s.40(1)-(2) · source ↗
Gouvernance
DPO requis
2
Statute lets controllers appoint a certified data protection supervisor; DPC guidance requires medium and large controllers to appoint one.s.58(1); DPC Guidelines to Demonstrate Compliance · source ↗
Legal force of the guideline over the statutory 'may' is unclear; size thresholds not published.
Qualifications du DPO
3
Supervisors must meet Commission criteria; the DPC certifies them after a course at an accredited institution and a DPC examination.s.58(6)-(7); CDPS Guidelines · source ↗
Enregistrement
3
Every data controller must register with the Commission, pay a fee and renew every two years; processing unregistered is an offense.ss.27, 46-50, 53, 56 · source ↗
Fee amounts not seen.
DPIA
1
No general DPIA duty; the Minister may designate assessable processing needing prior Commission review, and DPC guidance lists DPIAs as good practice.s.57; DPC Guidelines s.3 · source ↗
No executive instrument on assessable processing located.
Registres
2
No standalone record of processing duty; registration files the data held, purposes, recipients and transfer countries. DPC guidance recommends a RoPA.s.47; DPC Guidelines s.3 · source ↗
Level reflects particulars filed at registration.
Conservation
2
Data may not be kept longer than necessary and must then be destroyed, deleted or de-identified.s.24(1), (5) · source ↗
Violations
Informer le régulateur
1
Notify the Commission as soon as reasonably practicable after discovery; no fixed hour limit.s.31(1)-(2) · source ↗
Information des personnes
3
Notify affected data subjects in every case, as soon as reasonably practicable, unless delay is needed for a criminal investigation.s.31(1), (4) · source ↗
Transferts
Transferts à l’étranger
1
No general transfer restriction; controllers must ensure foreign processors comply and list transfer countries at registration.ss.18(2), 30(4), 47(1)(g) · source ↗
Application
Amende maximale
1
General penalty up to 5,000 penalty units (about GHS 60,000) and/or 10 years' imprisonment.s.95 · source ↗
Cedi value assumes GHS 12 per penalty unit under the Fines (Penalty Units) Act; not verified.
Responsabilité pénale
2
Offenses include processing without registration (2 years) and selling personal data (5 years); general penalty up to 10 years.ss.56, 89, 95 · source ↗
No general officer-liability clause except for credit bureaus (s.90(1)(c)).
Action privée
2
Individuals who suffer damage or distress from a contravention are entitled to compensation, subject to a reasonable care defense.s.43 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles