Sub-Data Processor Agreement (Ghana)

A Sub-Data Processor Agreement in Ghana records the obligations the parties accept and the terms governing their arrangement.

Ghana's data protection regime is administered by the Data Protection Commission (DPC), established under Section 3 of the Data Protection Act 2012 (Act 843). The DPC registers data controllers and data processors, issues guidelines on lawful processing, investigates complaints, and imposes administrative penalties for breaches of Act 843. Every entity in the processing chain — data controller, processor, and sub-processor — bears obligations directly under Act 843. The Sub-Data Processor Agreement documents how the sub-processor will meet those obligations in respect of the personal data it handles.

Personal data is defined broadly under Section 97 of Act 843 to include any information relating to an identified or identifiable individual. This includes names, contact details, identification numbers issued by the Ghana Revenue Authority (GRA) or Electoral Commission, financial account information, medical records, biometric data, and employee records. Sub-processing arrangements commonly arise when a Ghanaian technology company or financial institution subcontracts cloud storage, payroll processing, or customer service operations to a specialist third party.

The Electronic Transactions Act 2008 (Act 772) governs the legal validity of electronic records and electronic signatures in Ghana. Under Section 8 of Act 772, an electronic signature that reliably identifies the signatory satisfies any statutory requirement for a signature. A Sub-Data Processor Agreement executed electronically through a compliant platform is therefore fully enforceable before the High Court (Commercial Division) in Accra.

The Contract Act 1960 (Act 25) supplies the general law of contract governing the Sub-Data Processor Agreement in Ghana. The agreement must satisfy the foundational requirements of Act 25: offer, acceptance, consideration, capacity of the parties, and a lawful purpose. Because Act 843 mandates a written contract for all sub-processing arrangements, oral agreements for sub-processing of personal data are not enforceable in Ghana.

Companies incorporated under the Companies Act 2019 (Act 992) and registered with the Office of the Registrar of Companies (ORC) that operate as data controllers or processors must confirm that all sub-processing contracts are reviewed for compliance with Act 843 before execution. The Ghana Investment Promotion Centre (GIPC) under the GIPC Act 2013 (Act 865) regulates foreign investment in data-sensitive sectors, and sub-processing arrangements involving cross-border transfers of personal data out of Ghana must satisfy the transfer restrictions imposed by Act 843. The National Information Technology Agency (NITA) also issues standards relevant to information security obligations of data processors operating in Ghana.

A Sub-Data Processor Agreement in Ghana is required whenever a data processor that has contracted with a data controller to process personal data needs to engage a third party to perform any part of that processing. The agreement is mandatory under Section 28 of the Data Protection Act 2012 (Act 843) and must be in writing.

A Sub-Data Processor Agreement is needed when a Ghanaian financial institution licensed by the Bank of Ghana (BoG) under the Banks and Specialised Deposit-taking Institutions Act 2016 (Act 930) outsources core banking software processing, anti-money laundering screening, or know-your-customer (KYC) verification to a technology vendor that itself relies on a cloud infrastructure provider. The cloud provider is a sub-processor and must be bound by a Sub-Data Processor Agreement.

A Sub-Data Processor Agreement is required when a telecommunications operator licensed by the National Communications Authority (NCA) under the Electronic Communications Act 2008 (Act 775) engages a billing analytics company to process subscriber data. If that analytics company uses a data warehousing or artificial intelligence sub-vendor, a Sub-Data Processor Agreement must govern the onward transfer.

A Sub-Data Processor Agreement is needed when a human resources outsourcing firm registered with the Ghana Employers Association processes payroll data for multiple Ghanaian employers and subcontracts payslip generation or tax filing to an accounting software platform. The platform is a sub-processor of personal data under Act 843.

A Sub-Data Processor Agreement is required when a health management organisation accredited by the National Health Insurance Authority (NHIA) transfers patient medical records to a diagnostic laboratory or radiology centre. Medical data is a special category of sensitive personal data under Act 843, and sub-processing of such data requires enhanced safeguards.

Businesses should execute a Sub-Data Processor Agreement before commencing any sub-processing arrangement. Retroactive agreements do not cure liability for unauthorised processing that has already occurred. The Data Protection Commission (DPC) has authority to audit processor and sub-processor arrangements and may impose penalties under Act 843 for non-compliance.

Parties in Ghana should prepare a Sub-Data Processor Agreement (Ghana) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2019 (Act 992), the Registrar General's Department (RGD) maintains the register of Ghanaian companies. Section 7 of the Companies Act 2019 governs company incorporation. The Ghana Revenue Authority (GRA) administers corporate tax under the Income Tax Act 2015 (Act 896). The Commercial Division of the High Court in Accra adjudicates business disputes. The Ghana Investment Promotion Centre (GIPC) regulates foreign investment under the GIPC Act 2013 (Act 865). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A binding Sub-Data Processor Agreement in Ghana under the Data Protection Act 2012 (Act 843) and the Contract Act 1960 (Act 25) must contain the following essential elements.

Parties: Full legal names, registration numbers issued by the Office of the Registrar of Companies (ORC), and principal business addresses of the processor and the sub-processor. Where the processor is a regulated entity — for example, licensed by the Bank of Ghana (BoG), the National Communications Authority (NCA), or the National Health Insurance Authority (NHIA) — that regulatory status should be identified.

Data Controller Context: Identification of the original data controller on whose behalf the processor is acting, the data controller's registration number with the Data Protection Commission (DPC), and confirmation that the data controller has authorised the engagement of the sub-processor either generally or specifically as required by the main processing agreement.

Subject Matter and Nature of Processing: A precise description of the personal data categories to be processed by the sub-processor — for example, employee payroll data, customer transaction records, or patient health information — and the specific processing operations to be performed, such as storage, analysis, transmission, or deletion.

Purpose and Duration: The permitted purpose of the sub-processing, which must be consistent with the purpose for which the data controller collected the personal data, and the duration of the sub-processing arrangement. Processing beyond the agreed purpose or after expiry of the agreed term constitutes a breach of Act 843.

Data Subject Rights: Obligations on the sub-processor to support the processor in responding to data subject rights requests under Act 843, including the right to access personal data under Section 18, the right to correction under Section 20, and the right to object to processing under Section 22 of Act 843.

Security Measures: Technical and organisational security measures the sub-processor must implement, consistent with the requirements of Act 843 and any standards issued by the National Information Technology Agency (NITA). Measures should address access controls, encryption, pseudonymisation, incident response, and business continuity.

Breach Notification: An obligation on the sub-processor to notify the processor without undue delay — and in any event within 24 to 48 hours — upon becoming aware of any personal data breach, so that the processor can comply with its own breach notification obligations to the Data Protection Commission (DPC) and the affected data controller.

Further Sub-processing: A prohibition on the sub-processor engaging further sub-processors without prior written consent of the processor, and a requirement that any further sub-processor be bound by a Sub-Data Processor Agreement containing terms at least as protective as those in the primary agreement.

Cross-Border Transfers: Where the sub-processor is located outside Ghana or processes personal data outside Ghana, the agreement must include data transfer safeguards consistent with the transfer restriction provisions of Act 843, including adequacy assessments or contractual safeguards approved by the Data Protection Commission (DPC).

Audit Rights: A right for the processor — and by extension the data controller and the DPC — to audit the sub-processor's processing activities and security arrangements at reasonable intervals, and an obligation on the sub-processor to provide all information necessary to demonstrate compliance with Act 843.

Return or Deletion: An obligation on the sub-processor to return or securely delete all personal data upon termination of the agreement, and to certify in writing that deletion has been completed, unless Ghanaian law requires continued retention.

Governing Law and Dispute Resolution: Ghana law governs the agreement. Disputes may be referred to the High Court (Commercial Division) in Accra or to arbitration under the Alternative Dispute Resolution Act 2010 (Act 798) administered by the Ghana Arbitration Centre.

Forms-legal.com provides this Sub-Data Processor Agreement template as a starting point for businesses operating in Ghana. Entities handling sensitive personal data categories, cross-border transfers, or regulated financial data should consult a solicitor enrolled with the Ghana Bar Association and a data protection specialist conversant with Act 843 before executing the agreement.