Data Protection Act, special personal data

Data Protection Act, 2012 (Act 843), ss. 37-38 (special personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process special personal data, including a person's ethnicity, race, political opinion, religious belief, health, sexual life, or criminal behaviour, or the personal data of a child under parental control, unless a listed exception applies.
Process special personal data only where it is necessary or the data subject consents, treating processing as necessary where it exercises or performs a right or obligation the law imposes on an employer.
Where consent cannot be given or has been unreasonably withheld, process special personal data only to protect the vital interests of the data subject.
Do not process special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.

What it reaches

Obligation class

Prohibition, Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 37(1) prohibits processing personal data relating to a child under parental control, or to an individual's religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life, or criminal behaviour, unless the Act otherwise provides.

Section 37(2) permits a data controller to process special personal data only where the processing is necessary or the data subject consents, and section 37(3) treats processing as necessary where it exercises or performs a right or obligation the law imposes on an employer. Section 37(4) permits processing without consent only to protect the vital interests of a data subject who cannot give it, cannot reasonably be expected to give it, or has unreasonably withheld it.

Section 37(5) permits processing for the legitimate activities of a non-profit political, philosophical, religious, or trade union body, limited to its own members and never disclosed to a third party without the data subject's consent. Section 37(8) bars processing special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.

Section 38 exempts a spiritual or religious organisation, or an institution founded on religious or philosophical principles, from the prohibition on processing data about religious or philosophical belief where the processing concerns its own members, employees, or persons belonging to it.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
handles_health_records
serves_minors

Read the law

Data Protection Act, 2012 (Act 843), full gazetted text (National Information Technology Agency, Internet Archive copy)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived May 23, 2026. Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app