The Data Protection Commission (DPC) has referred a microfinance company and a health facility to the police for possible prosecution, as part of a nationwide enforcement drive targeting organisations that have failed to comply with Ghana’s data protection laws.
The enforcement exercise, conducted in Accra on Monday, October 12, 2026, covered institutions in the health, education and financial sectors and formed part of what the Commission has described as a “year of enforcement”. Officials found two hospitals operating with expired data protection certificates, while a third health facility had outstanding fees and other compliance issues.
“We Cannot Rely on Persuasion Alone”
Briefing the press after the exercise, the Executive Director of the Commission, Dr Arnold Kavaarpuo, said the Commission was no longer relying solely on education and persuasion to secure compliance, 14 years after the passage of the Data Protection Act, 2012 (Act 843).
“We cannot rely indefinitely on education and persuasion alone,” he said, adding that it would be unfair to organisations that had met their legal obligations if others were allowed to disregard the same requirements without consequences.
Dr Kavaarpuo stressed that registration alone did not amount to full compliance with the law. “An organisation may have a registration certificate and still fail to meet its obligations concerning the collection, use, storage and protection of personal information,” he said.
He disclosed that the Commission had recorded 2,575 data controller registrations in 2026, exceeding the annual figures for previous years, but stressed that registration and training must translate into compliance.
Microfinance Firm and Health Facilities Cited
The Director of Regulatory and Compliance at the Commission, Mr Quintin Akrobotu, provided details of the specific cases identified during the exercise.
He said the microfinance company had failed to renew its registration and complete a compliance report sent to it the previous year. Representatives of the company were scheduled to report to the Criminal Investigations Department (CID) headquarters on Tuesday, October 13, 2026, for possible prosecution.
Mr Akrobotu said the two health facilities visited were registered with the Commission, but their certificates had expired.
A third facility, a clinic, was found to have outstanding payments to the Commission and was directed to give a statement to the police. At the clinic, Mr Akrobotu said the facility had not appointed a Data Protection Supervisor and had unpaid fees dating back to at least January 2025. The clinic had also not conducted a privacy impact assessment of the electronic health system used to store patient records and lacked adequate organisational and technical measures to protect personal information.
The Commission expressed concern that the clinic was collecting sensitive information without the required arrangements and oversight to protect it.
The Legal Framework and Consequences
Section 56 of the Data Protection Act, 2012 (Act 843) makes the processing of personal data without the required registration punishable, upon summary conviction, by a fine, imprisonment for up to two years, or both. The law also provides for enforcement notices and other regulatory measures.
Under the Act, which was enacted pursuant to Article 18(2) of Ghana’s 1992 Constitution guaranteeing the right to privacy, all data controllers who intend to process personal information are required to register with the Commission. Registration must be renewed every two years.
Dr Kavaarpuo said the Commission would pursue prosecution where warranted, while ensuring that its actions remained fair, professional and consistent with due process. “Our primary objective is compliance, not punishment for its own sake, but organisations must understand that the law has consequences,” he said.
Nearly GH¢10m Lost to Online Fraud
The enforcement drive comes amid growing concerns about the misuse of personal data. Dr Kavaarpuo disclosed that nearly GH¢10 million was lost to online fraud in Ghana during the first six months of 2026.
“Imagine receiving a telephone call from someone who knows your full name, where you work, your Ghana Card details, and even the bank you use,” he said. “The person sounds convincing because they already know so much about you. They claim to be calling from your bank, persuading you to disclose one more detail, and shortly afterwards money disappears from your bank accounts. These are the kinds of risks we face when personal information falls into the wrong hands”.
He warned that the growing use of artificial intelligence was making the misuse of personal information more complex, with the technology capable of combining personal information, photographs and voice recordings to create convincing impersonations.
“When personal information is mishandled, the consequences do not remain within an organisation’s computer systems. They affect real people, their families and their livelihoods,” he said.
The “Year of Enforcement”
The Commission declared 2026 its “Year of Enforcement” in January, signalling a shift from awareness creation to active regulation. Dr Kavaarpuo said the enforcement drive was aimed at ensuring that institutions that collected and processed personal information complied with the requirements of Act 843.
He explained that compliance went beyond registration to include having appropriate data protection policies, conducting vulnerability and penetration assessments where necessary, undertaking data protection impact assessments for significant processing activities, and ensuring adequate safeguards for personal information.
The Commission has received two new pickup vehicles procured with its Internally Generated Funds to strengthen enforcement and support the establishment of regional offices. The Commission, which currently operates only from its head office, is taking steps to establish offices in the Eastern, Ashanti, Northern, Western and Bono regions by the end of the year.
National Security and Sensitive Data
The Executive Director said the Commission was particularly concerned about the protection of sensitive information, including children’s and health data, as well as information with national security implications.
He cautioned schools against using children’s photographs for promotional purposes without the required consent, stressing that “those students are there to school. They are not marketing objects”.
On health information, he said the Commission would pay closer attention to how such data was collected, stored, accessed and shared, given its sensitive nature.
“Data is as much a national security imperative as it is a commercial or personal nature,” he said, stressing the need for Ghana to safeguard its data infrastructure and protect citizens from identity theft, unauthorised access and other risks.
Public Advisory
Mr Akrobotu said the inspections would continue into 2027 and cover other sectors, including religious institutions and the media.
He advised the public to check whether institutions collecting their personal information held valid data protection certificates, and warned that failure to comply with data protection requirements could expose personal information to misuse, including sale to third parties and use in scams.
Dr Kavaarpuo urged organisations to review their compliance status, register where required and renew expired registrations.
The Commission’s intensified enforcement activities are intended to ensure that organisations comply with their legal obligations and handle personal information responsibly, he said.
