Data Subject Access Request Form (Ghana)

A Data Subject Access Request Form in Ghana puts a formal request before the recipient and sets out the grounds supporting it.

The Data Protection Act 2012 (Act 843) establishes the Data Protection Commission (DPC) as the supervisory authority in Ghana. The DPC is responsible for registering data controllers under Section 17, enforcing compliance with Act 843, and adjudicating complaints from data subjects who have been denied access to their personal data or whose rights under Act 843 have otherwise been infringed. A data subject who is denied access to their personal data may lodge a complaint with the DPC, which has the power to investigate and issue enforcement notices.

Personal data under Act 843 includes any information relating to an identified or identifiable natural person, including names, Ghana Card numbers issued by the National Identification Authority (NIA) under Act 707, SSNIT numbers, financial records, health records, employment records, communications data, and biometric data. Data controllers subject to Act 843 include all organisations that process personal data in Ghana — from banks licensed by the Bank of Ghana (BoG) and telecommunications operators licensed by the National Communications Authority (NCA), to employers, healthcare providers, e-commerce companies, and government agencies.

Section 10 of Act 843 requires the data controller to respond to a data subject access request within a reasonable time — the DPC's guidance indicates this should be within 30 days of receipt of the request. Where the data controller cannot comply within 30 days, the controller must notify the data subject of the expected response date. The data controller may charge a reasonable fee for responding to access requests, but excessive fees that deter data subjects from exercising their rights are inconsistent with Act 843.

A Data Subject Access Request Form in Ghana is distinct from a Data Correction Request, which a data subject uses to require a data controller to correct inaccurate personal data under Section 11 of Act 843, and from a Data Erasure Request, which requests deletion of personal data where retention is no longer justified. All three rights are available to data subjects under Act 843 and can be exercised using separate forms or combined in a single request.

The legal framework governing the Data Subject Access Request Form (Ghana) in Ghana draws on several key statutes and regulatory bodies. Under the Companies Act 2019 (Act 992), the Registrar General's Department (RGD) maintains the register of Ghanaian companies. Section 7 of the Companies Act 2019 governs company incorporation. The Ghana Revenue Authority (GRA) administers corporate tax under the Income Tax Act 2015 (Act 896). The Commercial Division of the High Court in Accra adjudicates business disputes. The Ghana Investment Promotion Centre (GIPC) regulates foreign investment under the GIPC Act 2013 (Act 865). Parties executing a Data Subject Access Request Form (Ghana) in Ghana should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Data Protection Act 2012 (Act 843) sets the foundational requirements.

A Data Subject Access Request Form in Ghana is required or useful in the following circumstances.

A Data Subject Access Request Form is needed when an individual in Ghana wishes to find out what personal data a bank licensed by the Bank of Ghana (BoG), an insurance company regulated by the National Insurance Commission (NIC), or another financial institution holds about them — for example, to check for inaccurate credit information or unauthorised transactions recorded in their name.

A Data Subject Access Request Form is required when a current or former employee wishes to access their employment records held by their employer, including performance reviews, disciplinary records, salary history, and SSNIT contribution records, in advance of a dispute before the National Labour Commission (NLC) or the High Court (Labour Division).

A Data Subject Access Request Form is needed when an individual suspects that a data controller has processed their personal data unlawfully — for example, sold their contact details to third parties without consent — and the individual wishes to obtain evidence of the processing before lodging a complaint with the Data Protection Commission (DPC).

A Data Subject Access Request Form is required when a patient at a Ghanaian healthcare facility wishes to obtain access to their medical records held in an electronic health information system, in accordance with both Act 843 s.10 and applicable Health Facilities Regulatory Agency (HeRAF) standards.

A Data Subject Access Request Form is needed when a data subject wishes to verify what personal data a telecommunications operator licensed by the National Communications Authority (NCA) has collected about their account, usage patterns, and location data, particularly following a suspected data breach.

A Data Subject Access Request Form is required when a data subject is exercising their rights before lodging a complaint with the DPC under Act 843, as the DPC may require evidence that the data subject first attempted to exercise their access rights directly with the data controller. Completing a Data Subject Access Request Form creates a formal record of the request and the date of submission.

Parties in Ghana should prepare a Data Subject Access Request Form (Ghana) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2019 (Act 992), the Registrar General's Department (RGD) maintains the register of Ghanaian companies. Section 7 of the Companies Act 2019 governs company incorporation. The Ghana Revenue Authority (GRA) administers corporate tax under the Income Tax Act 2015 (Act 896). The Commercial Division of the High Court in Accra adjudicates business disputes. The Ghana Investment Promotion Centre (GIPC) regulates foreign investment under the GIPC Act 2013 (Act 865). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A complete Data Subject Access Request Form in Ghana under the Data Protection Act 2012 (Act 843) s.10 must contain the following essential elements.

Data Subject Identity: Full legal name of the requesting individual; Ghana Card number issued by the National Identification Authority (NIA) under Act 707, or another form of government-issued identification; residential address or email address for delivery of the response; date of birth (to assist the data controller in locating the correct records); and any other identifier by which the data subject is known to the data controller — such as a customer account number, employee ID number, or patient reference number.

Identification of Data Controller: The full name and DPC registration number of the data controller to whom the request is addressed; the registered address or contact details of the data controller; and the name of the Data Protection Officer (DPO) or designated contact if known.

Description of Data Sought: A clear description of the specific personal data or categories of personal data to which access is sought — for example, all customer account records, all employment records, all health records, or all marketing data held by the data controller about the data subject. Where the request is broad, the data controller may ask the data subject to clarify before responding, but cannot refuse to respond on the grounds of breadth alone.

Purpose of Request: A brief statement of why the data subject is making the request — for example, to verify the accuracy of records held, to prepare for litigation, or to investigate a suspected breach. This is helpful but not required under Act 843 s.10.

Date and Signature: The date of the request and the data subject's signature (or electronic signature under the Electronic Transactions Act 2008 (Act 772)), confirming the accuracy of the identity information provided.

Proof of Identity: A copy of the data subject's Ghana Card or other government-issued identity document, to enable the data controller to verify the identity of the requestor and protect against fraudulent access requests.

Additional elements include: reference to Section 10 of the Data Protection Act 2012 (Act 843) as the legal basis for the request; a request for information on the source of the personal data if not collected directly from the data subject; and a request for details of any automated decision-making processes applied to the data subject's data. Forms-legal.com provides this template as a starting point for exercising data subject rights in Ghana.

Additional compliance elements for a Data Subject Access Request Form (Ghana) used in Ghana include: Under the Companies Act 2019 (Act 992), the Registrar General's Department (RGD) maintains the register of Ghanaian companies. Section 7 of the Companies Act 2019 governs company incorporation. The Ghana Revenue Authority (GRA) administers corporate tax under the Income Tax Act 2015 (Act 896). The Commercial Division of the High Court in Accra adjudicates business disputes. The Ghana Investment Promotion Centre (GIPC) regulates foreign investment under the GIPC Act 2013 (Act 865). Forms-legal.com provides this template as a starting point for Ghana-compliant documentation.