GhanaData Protection Act, enforcement, offences and penalties
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Comply with an enforcement notice the Commission serves within the time it states, and rectify, block, erase, or destroy other data containing an opinion based on data the Commission finds was processed in contravention of the Act.
- Notify a third party who received personal data that has since been rectified, blocked, erased, or destroyed of that change, where the Commission's enforcement notice requires it.
- Expect a data subject to seek compensation from you for damage or distress your contravention of the Act caused, unless you can prove you took reasonable care to comply.
- Do not purchase, knowingly obtain, or knowingly or recklessly disclose another person's personal data, and do not sell or offer to sell personal data.
- Comply with an information notice or enforcement notice the Commission issues after assessing a data subject's complaint about your processing.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Where a person commits an offence under the Act for which no penalty is specified, the general penalty is a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both (s. 95). Selling or offering to sell personal data, or knowingly or recklessly disclosing confidential Commission information about an identifiable individual, each carry a fine of not more than two thousand five hundred penalty units or imprisonment of not more than five years, or both (ss. 89, 85(3)). Purchasing, obtaining, or unlawfully disclosing personal data, requiring a person to produce a record as a condition of a service, failing to register as a data controller, or continuing assessable processing without the Commission's clearance, each carry a fine of not more than two hundred and fifty penalty units or imprisonment of not more than two years, or both (ss. 88, 82(3), 56, 57(6)). Failing to comply with an enforcement notice or an information notice, or making a false statement in response to one, carries a fine of not more than one hundred and fifty penalty units or imprisonment of not more than one year, or both (s. 80). An offence under Regulations made under the Act carries a fine of not more than five thousand penalty units (s. 94(2)).
Penalty structure
Section 95 (General penalty) sets the residual ceiling for any offence under the Act with no penalty otherwise specified: a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both. Named offences carry lower fixed tiers, for example two thousand five hundred penalty units for prohibited sale of personal data (s. 89) or unlawful disclosure of confidential Commission information (s. 85(3)), and two hundred fifty penalty units for prohibited purchase, obtaining, or disclosure of personal data (s. 88), for demanding a record as a condition of service (s. 82(3)), or for failure to register as a data controller (s. 56). One penalty unit equals twelve Ghana cedis under the Fines (Penalty Units) Act, 2000 (Act 572), as recorded by the Ghana Revenue Authority, making the general-penalty fine sixty thousand Ghana cedis.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- GHS
- Fixed cap
- 5,000
Who enforces it
Enforcement body
Data Protection Commission
What it reaches
Obligation class
Governance, Prohibition, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 75 lets the Commission serve a data controller who has contravened or is contravening a data protection principle with an enforcement notice requiring it to take or refrain from taking specified steps within a stated time, or to stop processing specified personal data. Section 76 lets the Commission cancel or vary an enforcement notice on its own motion or on the application of the person it was served on.
Section 77 lets a person affected by processing request the Commission to assess whether it complies with the Act, and section 78 lets the Commission make a formal determination that processing is inconsistent with the Act. Section 80 makes it an offence, carrying a fine of not more than one hundred and fifty penalty units or imprisonment of not more than one year or both, to fail to comply with an enforcement notice or an information notice, or to make a false statement in response to one.
Section 43 entitles an individual who suffers damage or distress through a data controller's contravention of the Act to compensation from that data controller, subject to the defence that the data controller took reasonable care to comply. Section 88 bars a person from purchasing, knowingly obtaining, or knowingly or recklessly disclosing another person's personal data, and section 89 bars selling or offering to sell personal data.
Section 95 sets the residual penalty for an offence under the Act with no penalty otherwise specified at a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisionsis_listed_company
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived May 23, 2026. Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.