Data Protection Commission
The Data Protection Commission (DPC) has warned that 2026 will mark the start of a full scale enforcement drive, with public and private institutions which process personal data without registration facing fines and possible imprisonment.
Executive Director of the Commission, Dr Arnold Kavaarpuo, said the DPC will intensify compliance checks and regulatory actions to ensure that data controllers and processors operate within the law. Speaking at the launch of Data Protection Week 2026 and a meet the press briefing in Accra on Monday, January 26, Dr Kavaarpuo said there will be no exemptions, stressing that the law clearly mandates registration and compliance under the Data Protection Act, 2012 (Act 843).
2026 will be a year of enforcement. The Data Protection Act emphasises compliance requirements for lawful data processing, and it also provides consequences for non compliance, Dr Kavaarpuo stated. He said institutions operating outside the law should expect sanctions.
Section 27(1) of Act 843 requires every data controller intending to process personal data to register with the Commission. This obligation is reinforced under Sections 46(3) and 53, with penalties including fines and imprisonment prescribed under Section 56. A person who fails to register as a data controller but processes personal data commits an offence and is liable on summary conviction to a fine of not more than 250 penalty units or a term of imprisonment of not more than two years or to both, according to the Act.
According to him, the Commission’s approach is not driven by punishment but by the need to build public trust in how personal data is handled in Ghana’s fast growing digital space. He said the enforcement drive is aimed at protecting citizens’ rights and strengthening trust in the country’s digital economy.
The Data Protection Month will be held on the theme Your Data, Your Identity: Building Trust in Ghana’s Digital Future. Dr Kavaarpuo announced that Data Protection Week 2026 has been expanded into a month long national programme running from January 26 and culminating in a National Data Protection Conference on February 25 and 26 in Accra.
He said the Commission made significant regulatory gains in 2025, including its largest nationwide public awareness campaign, which reached an estimated 25 million people, expanded registration of data controllers, compliance audits across key sectors and saw the training of more than 800 data protection officers.
The Commission also rolled out a digital registration and compliance platform, introduced the Data Protection Privacy Seal and deployed electronic, verifiable certificates to enable real time confirmation of compliance. The Privacy Seal serves as evidence of trust and compliance for registered data controllers.
Deputy Minister of Communications, Digital Technology and Innovations, Mohammed Adams Sukparu, who launched Data Protection Month 2026, said government fully supports the Commission’s enforcement stance, noting that trust in data handling is critical as Ghana deepens investments in digital identity, mobile money and e government systems.
This investment can only deliver full value when citizens trust that their personal data is handled lawfully, securely and responsibly, the deputy minister said. Mr Sukparu, who is also a Member of Parliament, stressed that protecting personal data is critical to Ghana’s digital transformation agenda and maintaining public confidence in digital services.
President of the Ghana Association of Privacy Professionals (GAPP), Emmanuel K. Gadasu, said trust is non negotiable in a digital economy where personal data increasingly determines access to finance, jobs and public services. He warned that misuse of data undermines personal autonomy and economic participation.
The President of the Ghana Association of Privacy Professionals, Emmanuel K. Gadasu, urged organisations to treat data protection officers as strategic assets rather than administrative burdens. He called on organizations to invest in data protection capacity, the media to enforce accountability and citizens to assert their data rights.
The Data Protection Act, 2012 (Act 843) establishes the Data Protection Commission as an independent statutory body to protect the privacy of individuals and personal data by regulating the processing of personal information. Under the Act, a penalty unit is equivalent to GHS 12.
The DPC is also in talks with the Chief Justice to create a fast track High Court to hear data protection related matters, which will aid in the quick prosecution of bodies that contravene the Act. The Commission intends to impose the hiring of data protection supervisors on companies that have breached the Act to monitor compliance.
