Data Protection Commission intensifies compliance inspections across Ghanaian institutions

The Data Protection Commission (DPC) has intensified its compliance monitoring and enforcement efforts, warning institutions that collect and process personal information to comply with Ghana’s Data Protection Act, 2012 (Act 843).

The move comes amid concerns that the misuse or improper handling of personal data could expose individuals to fraud, harassment, discrimination and financial losses.

Speaking to the media ahead of a series of compliance spot checks, DPC Executive Director Dr. Arnold Kavaarpuo said the exercise forms part of the Commission’s decision to make 2026 a year of enforcement after years of public education, training and engagement with institutions.

He stressed that obtaining a registration certificate did not automatically guarantee compliance with data protection requirements.

“An organization may have a registration certificate and still fail to meet its obligations concerning the collection, use, storage, and protection of personal information,” he said.

Dr. Kavaarpuo noted that institutions routinely handle sensitive information, including financial records, medical histories, employment details and children’s personal data.

He warned that inadequate protection of such information could expose individuals to fraud, harassment, discrimination and reputational damage.

The Executive Director explained that the Data Protection Act requires organisations to establish a lawful basis for processing personal information, safeguard it against misuse and ensure that it is not used for purposes without proper legal justification.

As part of the exercise, the Commission’s compliance team, accompanied by journalists and personnel from the Criminal Investigations Department (CID), inspected five institutions: Nuffield Hospital, Nyaho Clinic, Airport Women’s Hospital, Ghana International School (GIS) and DCI Microfinance.

DPC Director of Regulatory and Compliance, Quintin Akrobotu, said the inspections revealed differing levels of compliance among the institutions.

He disclosed that Nuffield Hospital had applied for registration and made some payments but was yet to settle its outstanding balance.

Nyaho Clinic, he said, had previously registered with the Commission, but its certification had expired, with the renewal process yet to be completed.

Airport Women’s Hospital had also allowed its certification to expire. However, the facility had appointed a data protection supervisor and was working to fulfil additional requirements, including the development of appropriate policies and safeguards.

At DCI Microfinance, Akrobotu said a renewal application had been submitted, but the process remained incomplete despite the institution receiving a compliance report requiring it to demonstrate the measures in place to protect personal information.

Ghana International School, on the other hand, was found to have met the requirements assessed during the exercise, including registration and the appointment of a data protection supervisor.

Akrobotu said institutions with outstanding compliance issues would be expected to address them, while any further action would depend on the outcome of investigations and the applicable legal procedures.

He clarified that the existence of outstanding issues did not automatically mean that all affected institutions would face prosecution.

The Commission has also urged the public to exercise caution when sharing personal information with institutions and service providers.

Akrobotu advised individuals to verify whether an organisation holds valid data protection certification before submitting their personal details.

“If the institution cannot provide their data protection certificate, valid certification, that shows that they have the capacity to collect and protect your information, don’t give out your information,” he said.

He cautioned that information provided to organisations with inadequate data protection measures could fall into the hands of third parties, exposing individuals to unsolicited communications and potential scams.

The Commission, however, emphasised that the primary responsibility for complying with data protection requirements rests with the organisations that collect and process personal information.

Akrobotu said the spot checks would continue across various sectors of the economy, including religious institutions and media organisations.

He stressed that the Commission had the legal authority to inspect facilities to assess their compliance status without seeking prior permission from the institutions concerned.

“The Data Protection Commission does not need your permission to count your facility to check for compliance status,” he said.

He added that the inspections would be conducted weekly and continue into next year.

Dr. Kavaarpuo said the exercise was not intended to punish institutions unnecessarily but to ensure they fulfilled their legal obligations and protected the personal information entrusted to them.

“Ultimately, this is about protecting the people behind the personal records,” he said, referring to patients, customers and children whose information is held by various institutions.

The Commission maintains that responsible handling of personal information is essential to safeguarding individual privacy and sustaining public trust as digital services become increasingly integrated into everyday life.

By Esther Padmore Amonoo