The Data Protection Commission (DPC) in Ghana will commence spot checks and enforcement actions against organisations that process personal data without meeting the required statutory obligations, starting October 5. This move targets organisations that have failed to register with the Commission or meet other requirements under the Data Protection Act, 2012 (Act 843). The exercise aims to ensure compliance with data protection laws.
According to Dr. Arnold Kavaarpuo, Executive Director of the DPC, the Commission has spent the past year educating organisations and individuals about their responsibilities and rights under the law. The DPC launched the “Privacy is Personal” campaign in October 2025 to educate data controllers, data processors, and data subjects on their roles. The Commission has now shifted its focus from awareness creation to enforcement.
Organisations acting as data controllers are required to register with the Commission before processing personal data and renew their registration as required. Processing personal information without the required registration constitutes an offence under the law. The spot checks will assess registration, lawful processing, protection of personal data, and other obligations under the Act.
The DPC has identified some non-compliant entities and will take regulatory and enforcement action, including prosecution where necessary. Dr. Kavaarpuo urged organisations yet to register or regularise their status to do so before the spot checks begin. The Commission’s message is: “Check your status. Regularise your compliance. Protect personal data.”
The enforcement exercise is part of the Commission's mandate to ensure that organisations handle personal data in accordance with the Data Protection Act. The DPC aims to promote a culture of data protection and respect for individuals' rights. By enforcing compliance, the Commission seeks to prevent data breaches and protect the rights of data subjects.
Dr. Kavaarpuo emphasised that the Commission is committed to ensuring that organisations adhere to the mandates of the Commission. The DPC will continue to engage with stakeholders to promote data protection and compliance. The spot checks are a crucial step in the Commission's efforts to enforce data protection laws and promote a culture of compliance.
The Data Protection Commission's efforts to enforce compliance with data protection laws are crucial in protecting the rights of individuals and promoting trust in the digital economy. The Commission's work will help to ensure that organisations handle personal data responsibly and in accordance with the law. By doing so, the DPC aims to promote a culture of data protection and respect for individuals' rights in Ghana.
Key points
- The Data Protection Commission will start spot checks on organisations processing personal data without meeting statutory requirements from October 5.
- Organisations must register with the Commission before processing personal data and renew their registration as required.
- The Commission will take regulatory and enforcement action, including prosecution, against non-compliant entities.
