Data Protection Commission steps up compliance checks across key Ghanaian institutions

Every day, Ghanaians hand over personal information to institutions they trust, from hospitals and schools to banks and digital service providers. But when that information is mishandled, the consequences can extend beyond unwanted calls and messages to fraud, harassment, and financial loss.

The Data Protection Commission (DPC) is intensifying its compliance monitoring and enforcement activities, warning organizations that collect and process personal information to meet their obligations under Ghana’s Data Protection Act, 2012 (Act 843).

Speaking to the media ahead of a series of compliance spot checks, DPC Executive Director Dr. Arnold Kavaarpuo said the exercise forms part of the Commission’s decision to make 2026 a year of enforcement, following years of public education, training, and engagement with institutions.

“An organization may have a registration certificate and still fail to meet its obligations concerning the collection, use, storage, and protection of personal information,” he said.

Dr. Kavaarpuo explained that institutions routinely receive sensitive information from the public, including financial details, medical records, employment information, and children’s personal data. He warned that when such information falls into the wrong hands, individuals may face fraud, discrimination, harassment, and reputational damage.

He said the Data Protection Act establishes responsibilities for organizations that collect and process personal data, including the need to have a lawful basis for processing information, protect it against misuse, and avoid using it for purposes that are not legally justified.

Five institutions inspected

The Commission’s compliance team, accompanied by the media and personnel from the Criminal Investigations Department (CID), visited five institutions: Nuffield Hospital, Nyaho Clinic, Airport Women’s Hospital, Ghana International School (GIS), and DCI Microfinance.

Director of Regulatory and Compliance at the DPC, Quintin Akrobotu, said the visits revealed varying levels of compliance.

According to him, Nuffield Hospital had applied for registration and made some payments but had outstanding payments to complete. Nyaho Clinic had previously registered, but its certification had expired, with the renewal process still incomplete.

Airport Women’s Hospital had also registered, but its certification had expired. Akrobotu said the hospital had appointed a data protection supervisor and was working towards completing additional requirements, including putting the necessary policies and safeguards in place.

At DCI Microfinance, he said the institution had submitted a renewal application but had not completed the process despite receiving a compliance report requiring it to demonstrate the measures in place to safeguard personal information.

Ghana International School was identified by the Commission as meeting the requirements assessed during the exercise, including registration and the appointment of a data protection supervisor.

Akrobotu said the institutions with outstanding issues would be expected to address them, while any further action would depend on investigations and the applicable legal processes. He did not confirm that all institutions with outstanding issues would face prosecution.

Public urged to be cautious

The Commission is also urging members of the public to take greater care when sharing personal information with organizations.

Akrobotu advised individuals to ask whether an institution has valid data protection certification before handing over their information.

“If the institution cannot provide their data protection certificate, valid certification, that shows that they have the capacity to collect and protect your information, don’t give out your information,” he said.

He cautioned that information shared with organizations that do not adequately protect it may reach third parties and expose individuals to unwanted messages and potential scams.

However, responsibility for compliance rests with the organizations collecting and processing the information, the Commission has emphasized.

Checks to continue across sectors

Akrobotu said the spot checks would continue beyond the current exercise, extending to other sectors of the economy, including religious institutions and the media.

“The Data Protection Commission does not need your permission to count your facility to check for compliance status,” he said, referring to the Commission’s authority to conduct inspections under the law.

He added that the checks would continue “week on week” and extend into next year.

Dr. Kavaarpuo said the objective was not punishment for its own sake, but ensuring that organizations respected their legal obligations and protected the people whose information they held.

“Ultimately, this is about protecting the people behind the personal records,” he said, pointing to patients, customers, and children whose information is entrusted to institutions.

As digital services become more embedded in everyday life, the Commission says responsible handling of personal information remains essential to public trust.