Every time you register a SIM, open a bank account, sign up for an app or fill in a form at a shop, you hand over personal information: your name, phone number, Ghana Card number, address, sometimes your photo and fingerprints. Ghana has a law about what organisations may do with that information, and it gives you rights too.

That law is the Data Protection Act, 2012 (Act 843). It is enforced by the Data Protection Commission (DPC). This guide explains it in plain words. It is general information, not legal advice.

Who the law applies to

The Act applies to organisations and people who collect and use personal data, which the law calls data controllers. That includes banks, telcos, hospitals, schools, employers, online shops, apps and many small businesses.

Data controllers are required to register with the Data Protection Commission. According to the DPC, a registered controller receives a Certificate of Registration valid for two years, which must then be renewed. The Commission keeps a public register, so you can check whether an organisation is registered.

The principles organisations must follow

In plain terms, organisations that handle your data are expected to:

  • Be accountable for the data they collect.
  • Collect it lawfully and fairly, for a specific purpose you can understand.
  • Only use it for that purpose, not quietly for something else.
  • Keep it accurate and up to date.
  • Keep it secure against loss, theft and misuse.
  • Be open about what they hold and why.
  • Let you exercise your rights over your data.

Your rights

The right to know and to access

You can ask an organisation whether it holds personal data about you, and ask for a copy. The DPC describes this as part of the openness principle: you have a right to access your personal information.

The right to correct

If information about you is wrong, out of date or incomplete, you can ask for it to be corrected.

The right to object and to have data deleted

In certain situations you can object to how your data is used, including for direct marketing, and ask for data to be deleted when it is no longer needed for the purpose it was collected for.

The right to complain

If you believe an organisation has misused your data, you can complain to the Data Protection Commission.

Tired of marketing SMS and calls? You can object to direct marketing. Ask the company to stop using your data for marketing, and keep a record of when you asked.

How to make a request

  1. Contact the organisation in writing (email or letter) and say clearly what you want: a copy of your data, a correction, or that they stop using it for marketing.
  2. Include enough information for them to identify you, but do not send more than needed.
  3. Keep a copy of your request and note the date.
  4. If they do not respond reasonably, or you believe the law has been broken, contact the Data Protection Commission.

Protecting your own data

  • Ask why before giving your Ghana Card number or photo to a shop, event or website. Is it really needed?
  • Read before you tick. Consent boxes often include marketing permissions.
  • Be careful with apps that ask for access to your contacts, SMS or location without a clear reason.
  • Watch out for loan apps that want access to your contacts. Misuse of contacts to shame borrowers has been a recurring complaint in many countries.
Your data is yours. Organisations are allowed to use it, not to own it.

A note on change

Data protection rules are being updated in many countries, and reports suggest Ghana is reviewing its law too. Check the Data Protection Commission’s website for the latest guidance.

This guide was checked in October 2026. Menus and services change, so if something looks different on your phone, check with your provider.

Common questions

Does the Act apply to small businesses?

The Act applies to those who process personal data, which can include small businesses that keep customer records. Check the Data Protection Commission’s guidance for your situation.

Can a shop insist on my Ghana Card number?

Some services are legally required to verify identity, such as SIM registration and banking. For other cases, ask why it is needed and how it will be protected.

How do I check whether a company is registered?

The Data Protection Commission keeps a register you can check, as described on its website.

No. This guide explains the law in general terms. For a specific problem, contact the Data Protection Commission or a lawyer.

Sources