The Data Protection Commission (DPC) has flagged six companies operating in the Kaneshie North Industrial Area and Tudu for failing to comply with the country’s data protection laws.
The companies are Polytex Ghana Limited, JA Biney Packaging, Qualiplast Limited, Bragha Company Limited, Melcom Group of Companies and Menkish Impex Ltd.
They were cited for operating without registering with the Commission, using expired certificates or failing to renew their registrations.
The companies have been directed to report to the Cyber Security Unit of the Criminal Investigations Department (CID) at the Police Headquarters and the DPC by Thursday, October 15, to address the breaches.
The violations were identified during compliance checks on Wednesday as part of a week-long enforcement exercise aimed at ensuring that organisations handling personal data complied with the law and adopted measures to safeguard such information.
Briefing the media after the exercise on Wednesday, Mr Quintin Akrobotu, Director of Regulatory and Compliance at the DPC, said some companies had operated and collected or processed personal data for years without registering with the Commission.
He said Polytex Ghana Limited had failed to demonstrate adequate knowledge of data protection requirements and could not produce a valid certificate to support its data processing activities. The company had been invited by the CID’s Cybercrime Unit to explain its failure to register.
JA Biney Packaging was also found to be unregistered, although it had agreed to take steps to comply. It was directed to report to the CID to provide a statement.
Qualiplast Limited similarly failed to produce a valid data protection certificate but had expressed willingness to implement the required measures. It was also expected to explain its non-compliance to the CID.
Bragha Company Limited, an oil and gas firm, was cited for operating for about 30 years without a valid data protection certificate or completing its registration. It was invited to meet the CID and the DPC.
Menkish Impex Ltd’s registration expired in 2019, and the company failed to renew it. It was directed to regularise its status with the Commission and explain the lapse to the CID.
Melcom, however, received commendation for its compliance efforts. Mr Akrobotu said the retailer was processing its licence renewal and training three professionals, including one appointed as its data protection supervisor, as required under Section 58 of the Data Protection Act.
He said the company was expected to take further steps towards full compliance after the training, warning that ignorance of the law would not be tolerated.
“Ignorance is no excuse,” he said, adding that the Commission educated organisations on their obligations through publications, its website and social media platforms.
Mr Akrobotu said Section 53 of the Data Protection Act prohibited data controllers from processing personal information without registering with the Commission.
He said the enforcement exercise, conducted under Section 81 of the Act, would continue beyond the week and into next year, with further inspections planned across the country.
He also commended companies cited in an earlier crackdown for contacting the Commission to work towards compliance.
“Our target is not to embarrass institutions. We want them to comply,” he said.