Data Protection Compliance Form (Ghana)

A Data Protection Compliance Form in Ghana organises the details a party must supply for the purpose it serves.

The Data Protection Act 2012 (Act 843) is the primary legislation governing personal data protection in Ghana. Act 843 establishes the Data Protection Commission (DPC) as the supervisory authority and requires every data controller that processes personal data in Ghana to register with the DPC under Section 17 before commencing processing. Section 18 of Act 843 sets out the data protection principles that all processing must comply with: personal data must be processed lawfully and fairly; collected for specified, explicit, and legitimate purposes; adequate, relevant, and not excessive; accurate and up to date; not kept longer than necessary; and processed in a manner confirming appropriate security.

Section 22 of Act 843 sets out the conditions for lawful processing: processing is lawful where the data subject has given consent; processing is necessary for performance of a contract to which the data subject is party; processing is necessary for compliance with a legal obligation; processing is necessary to protect the vital interests of the data subject; or processing is necessary for the performance of a task carried out in the public interest.

The National Identification Authority (NIA) issues the Ghana Card under Act 707, and the Ghana Card number constitutes personal data subject to Act 843. Banks licensed by the Bank of Ghana (BoG), insurance companies regulated by the National Insurance Commission (NIC), and telecommunications operators licensed by the National Communications Authority (NCA) are among the largest data controllers in Ghana and are subject to both Act 843 and their sector-specific data governance requirements.

A Data Protection Compliance Form in Ghana is distinct from the DPC registration form submitted to the Commission — it is an internal organisational document that tracks compliance readiness and serves as evidence of good-faith effort to comply with Act 843 in the event of a DPC investigation or audit. Forms-legal.com provides this template for organisations conducting self-assessments of their data protection compliance posture in Ghana.

The legal framework governing the Data Protection Compliance Form (Ghana) in Ghana draws on several key statutes and regulatory bodies. Under the Companies Act 2019 (Act 992), the Registrar General's Department (RGD) maintains the register of Ghanaian companies. Section 7 of the Companies Act 2019 governs company incorporation. The Ghana Revenue Authority (GRA) administers corporate tax under the Income Tax Act 2015 (Act 896). The Commercial Division of the High Court in Accra adjudicates business disputes. The Ghana Investment Promotion Centre (GIPC) regulates foreign investment under the GIPC Act 2013 (Act 865). Parties executing a Data Protection Compliance Form (Ghana) in Ghana should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Data Protection Act 2012 (Act 843) sets the foundational requirements.

A Data Protection Compliance Form in Ghana is required or strongly recommended in the following circumstances.

A Data Protection Compliance Form is needed when an organisation is preparing to register with the Data Protection Commission (DPC) under Section 17 of the Data Protection Act 2012 (Act 843) and wishes to document its processing activities and compliance measures before submitting the registration application.

A Data Protection Compliance Form is required when a data controller is responding to a DPC investigation or audit and needs to produce evidence of compliance with the data protection principles under Section 18 of Act 843 and the conditions for lawful processing under Section 22.

A Data Protection Compliance Form is needed when a company incorporated under the Companies Act 2019 (Act 992) is conducting an annual data protection compliance review — particularly banks regulated by the Bank of Ghana (BoG), insurance companies regulated by the National Insurance Commission (NIC), or telecommunications operators regulated by the National Communications Authority (NCA) — to confirm alignment with both Act 843 and sector-specific data governance requirements.

A Data Protection Compliance Form is required when an organisation appoints a new Data Protection Officer (DPO) and the DPO is carrying out an initial gap assessment of the organisation's data protection posture to identify areas requiring remediation.

A Data Protection Compliance Form is needed when a business is engaged in due diligence for a merger, acquisition, or investment transaction under the Companies Act 2019 (Act 992), and the prospective acquirer or investor requires the target company to demonstrate its data protection compliance status.

A Data Protection Compliance Form is required when an organisation is implementing a new data processing system — such as a new customer relationship management (CRM) platform, payroll system, or health information management system — and needs to conduct a data protection impact assessment to identify risks before processing commences. Completing a Data Protection Compliance Form proactively reduces the risk of DPC enforcement action and demonstrates good-faith compliance with Act 843.

A thorough Data Protection Compliance Form in Ghana under the Data Protection Act 2012 (Act 843) must contain the following essential elements.

Organisation Details: Full legal name of the data controller; DPC registration number under Section 17 of Act 843 (or confirmation that registration is pending); company registration number issued by the Office of the Registrar of Companies (ORC) under the Companies Act 2019 (Act 992); registered address in Ghana; sector of operation; and the name and contact details of the appointed Data Protection Officer (DPO) or designated data protection contact.

Processing Activities Register: A systematic inventory of the categories of personal data processed — such as names, Ghana Card numbers, SSNIT numbers, financial data, health data, or biometric data; the categories of data subjects — such as customers, employees, or members of the public; the purposes of processing for each category; the legal basis under Section 22 of Act 843 for each processing activity; the retention periods applicable to each category; and the third parties (processors or other controllers) with whom personal data is shared.

Data Protection Principles Compliance: A self-assessment of compliance with each data protection principle under Section 18 of Act 843: lawfulness and fairness; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

Data Subject Rights Procedures: Documentation of the procedures in place to enable data subjects to exercise their rights under Act 843, including: the right of access under Section 10; the right to correction under Section 11; the right to object to processing; and the right to withdraw consent. Response timeframes and escalation procedures should be described.

Security Measures: A description of the technical and organisational measures implemented to protect personal data against unauthorised access, loss, or destruction, consistent with the Cybersecurity Act 2020 (Act 1038) and the Cyber Security Authority's (CSA) guidelines. Measures should include access controls, encryption, staff training, and incident response procedures.

Data Breach Response: A description of the data breach detection, assessment, and notification procedures in place, including the procedure for notifying the DPC under Section 30 of Act 843 without undue delay.

Additional compliance elements include: records of staff data protection training; documentation of data protection impact assessments (DPIAs) conducted for high-risk processing; and evidence of Data Processing Agreements executed with processors under Section 37 of Act 843. Forms-legal.com provides this template as a starting point for Ghana data protection compliance documentation.

Additional compliance elements for a Data Protection Compliance Form (Ghana) used in Ghana include: Under the Companies Act 2019 (Act 992), the Registrar General's Department (RGD) maintains the register of Ghanaian companies. Section 7 of the Companies Act 2019 governs company incorporation. The Ghana Revenue Authority (GRA) administers corporate tax under the Income Tax Act 2015 (Act 896). The Commercial Division of the High Court in Accra adjudicates business disputes. The Ghana Investment Promotion Centre (GIPC) regulates foreign investment under the GIPC Act 2013 (Act 865). Forms-legal.com provides this template as a starting point for Ghana-compliant documentation.