Personal Data Processing Consent Form (Ghana)
Personal Data Processing Consent Form
This Personal Data Processing Consent Form is issued by [Controller Name], of [Controller Address], Data Protection Commission Registration No. [DPC Registration Number] (the "Data Controller"), in accordance with the Data Protection Act 2012 (Act 843) of Ghana.
Date: [Consent Date] | Data Protection Officer / Privacy Contact: [DPO Contact]
1. Data Subject
Data Subject: [Subject Name], Ghana Card No.: [Subject Ghana Card], Email: [Subject Email], Phone: [Subject Phone].
2. Data Collected and Purpose of Processing
The Data Controller will collect and process the following categories of personal data: [Data Categories].
The personal data will be processed for the following specific purposes: [Processing Purposes].
The processing includes sensitive personal data: [Sensitive Data]. The legal basis for processing is: [Legal Basis].
3. Data Sharing and Retention
Personal data may be shared with the following third parties: [Data Recipients]. Any data processor engaged by the Data Controller will be subject to a data processing agreement under Section 19 of Act 843.
Personal data will be retained for: [Retention Period], after which it will be deleted or anonymised.
International transfer of data outside Ghana: [International Transfer]. Where data is transferred outside Ghana, appropriate safeguards will be implemented in accordance with Act 843.
4. Data Subject Rights
Under the Data Protection Act 2012 (Act 843), the Data Subject has the right to: (a) access a copy of their personal data held by the Data Controller (Section 33 of Act 843); (b) request rectification of inaccurate data; (c) request erasure of data where processing was unlawful or the purpose has ceased; (d) object to processing based on legitimate interests or for direct marketing; and (e) withdraw this consent at any time without detriment by contacting the Data Protection Officer at [DPO Contact]. Complaints may be referred to the Data Protection Commission (DPC).
5. Consent
I, [Subject Name], confirm that I have read and understood this consent form. I freely, specifically, and unambiguously give my consent to the Data Controller [Controller Name] to process my personal data as described above for the stated purposes, in accordance with Section 17 of the Data Protection Act 2012 (Act 843). I understand that I may withdraw this consent at any time.
Data Subject
________________
Signature
Data Controller Representative
________________
Signature
What Is a Personal Data Processing Consent Form (Ghana)?
A Personal Data Processing Consent Form in Ghana grants documented consent to the action it describes, on the conditions it states.
The Data Protection Act 2012 (Act 843) is the principal legislation governing the processing of personal data in Ghana. Act 843 establishes the Data Protection Commission (DPC) as the independent supervisory authority responsible for enforcing data protection law in Ghana. Section 17 of Act 843 requires that processing of personal data be based on one of the prescribed grounds: consent of the data subject; performance of a contract to which the data subject is party; compliance with a legal obligation; protection of the vital interests of the data subject; performance of a task carried out in the public interest; or the legitimate interests of the data controller, except where overridden by the interests of the data subject.
Where consent is the chosen legal basis for processing, Act 843 requires that the consent be freely given — not a precondition of service unless the processing is strictly necessary — specific to clearly identified purposes, informed by a plain-language description of the processing, and unambiguous. The data subject must be able to withdraw consent at any time without detriment. Data controllers in Ghana must register with the Data Protection Commission under Section 27 of Act 843 before commencing processing operations.
The Personal Data Processing Consent Form in Ghana is distinct from a Privacy Policy (which describes the organisation's overall data practices) and from a Data Processing Agreement (which governs the relationship between a data controller and a data processor under Section 19 of Act 843). The consent form is a direct communication between the data controller and the individual data subject.
The Electronic Transactions Act 2008 (Act 772) and the Electronic Communications Act 2008 (Act 775) are relevant where consent is obtained electronically — for example, through a website tick-box or mobile application in Ghana. Electronic consent must meet the same substantive standards as written consent under Act 843.
The legal framework governing the Personal Data Processing Consent Form (Ghana) in Ghana draws on several key statutes and regulatory bodies. Under Ghanaian law, the Data Protection Act 2012 (Act 843) and the Data Protection Commission govern personal data processing. The Marriages Act 1884-1985 (Cap. 127) and Marriages Ordinance (Cap. 127) govern civil marriages. The Intestate Succession Law 1985 (PNDC Law 111) overrides customary succession for specified relatives. The Courts Act 1993 (Act 459) governs court procedures. The Children's Act 1998 (Act 560) governs child welfare. Parties executing a Personal Data Processing Consent Form (Ghana) in Ghana should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Data Protection Act 2012 (Act 843) sets the foundational requirements.
When Do You Need a Personal Data Processing Consent Form (Ghana)?
A Personal Data Processing Consent Form in Ghana is needed in the following circumstances.
A Personal Data Processing Consent Form is required when a company, NGO, or public institution in Ghana collects personal data from individuals — such as customers, employees, beneficiaries, or research participants — for purposes that require the individual's consent as the lawful basis under Section 17 of the Data Protection Act 2012 (Act 843).
A Personal Data Processing Consent Form is needed when a healthcare provider — such as a hospital, clinic, pharmacy, or health insurance company regulated by the National Insurance Commission (NIC) — collects sensitive personal data, including medical history, test results, and health insurance information, from patients in Ghana. Health data constitutes sensitive personal data under Act 843 and requires explicit consent.
A Personal Data Processing Consent Form is required when a financial institution — including a bank licensed by the Bank of Ghana (BoG), a mobile money operator, or a fintech company — collects personal and financial data from customers for KYC (Know Your Customer) compliance under the Anti-Money Laundering Act 2020 (Act 1044), credit assessment, or marketing purposes.
A Personal Data Processing Consent Form is needed when a school, university, or training institution collects personal data about students, parents, or alumni in Ghana for enrolment, examination, alumni relations, or fundraising communications.
A Personal Data Processing Consent Form is required when an employer in Ghana processes the biometric data, Ghana Card numbers, or medical records of employees — categories that attract heightened protection under Act 843.
Organisations that process personal data in Ghana must register with the Data Protection Commission and maintain appropriate records of processing activities. Obtaining and retaining properly documented consent protects the organisation in the event of a data subject complaint or DPC investigation.
Parties in Ghana should prepare a Personal Data Processing Consent Form (Ghana) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Ghanaian law, the Data Protection Act 2012 (Act 843) and the Data Protection Commission govern personal data processing. The Marriages Act 1884-1985 (Cap. 127) and Marriages Ordinance (Cap. 127) govern civil marriages. The Intestate Succession Law 1985 (PNDC Law 111) overrides customary succession for specified relatives. The Courts Act 1993 (Act 459) governs court procedures. The Children's Act 1998 (Act 560) governs child welfare. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.
What to Include in Your Personal Data Processing Consent Form (Ghana)
A valid Personal Data Processing Consent Form in Ghana under the Data Protection Act 2012 (Act 843) must contain the following essential elements.
Data Controller Identity: Full name, address, registration number (where applicable), and contact details of the data controller — the organisation collecting and processing the personal data. The data controller must be registered with the Data Protection Commission (DPC) under Section 27 of Act 843.
Data Subject Identity: Full name and contact details of the data subject, confirming they are an adult of at least 18 years or, if a minor, that the consent of a parent or guardian has been obtained.
Categories of Personal Data: A clear, plain-language description of the categories of personal data to be collected — for example, name, date of birth, Ghana Card number (National Identification Authority), address, email address, mobile number, employment information, financial data, health data, or biometric data.
Purposes of Processing: Each specific, identified purpose for which the data will be processed, stated in plain language — for example, service delivery, marketing, research, statutory compliance, credit assessment, or employee payroll administration.
Legal Basis: Confirmation that consent under Section 17 of Act 843 is the lawful basis for the processing activity described, and acknowledgement by the data controller that consent may be withdrawn at any time.
Data Sharing and Transfer: Identification of any third parties — including processors under Section 19 of Act 843, affiliated companies, or international recipients — to whom data may be transferred, and the basis for such transfer (including adequacy determination or appropriate safeguards for cross-border transfers).
Retention Period: The period for which the personal data will be retained before deletion or anonymisation, consistent with Act 843's data minimisation and storage limitation principles.
Data Subject Rights: A clear statement of the data subject's rights under Act 843 — including the right to access, rectification, erasure, and withdrawal of consent — and the contact details of the Data Protection Officer (DPO) or privacy contact at the data controller.
Signature and Date: The data subject's signed and dated consent, confirming that the consent is freely given, specific, informed, and unambiguous. Forms-legal.com provides this template as a starting point for Act 843-compliant data processing documentation in Ghana.
Additional compliance elements for a Personal Data Processing Consent Form (Ghana) used in Ghana include: Under Ghanaian law, the Data Protection Act 2012 (Act 843) and the Data Protection Commission govern personal data processing. The Marriages Act 1884-1985 (Cap. 127) and Marriages Ordinance (Cap. 127) govern civil marriages. The Intestate Succession Law 1985 (PNDC Law 111) overrides customary succession for specified relatives. The Courts Act 1993 (Act 459) governs court procedures. The Children's Act 1998 (Act 560) governs child welfare. Forms-legal.com provides this template as a starting point for Ghana-compliant documentation.
Sources & Citations
Statutory citations link to official government sources.
- Marriages Ordinance (Cap. 127)HK official
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Personal Data Processing Consent Form (Ghana) (Ghana) [Legal document template]. Forms Legal. https://forms-legal.com/ghana/personal/consent/data-processing-consent-form-ghana
"Personal Data Processing Consent Form (Ghana) (Ghana)." Forms Legal, 2026, https://forms-legal.com/ghana/personal/consent/data-processing-consent-form-ghana.
@misc{formslegal-data-processing-consent-form-ghana,
author = {{Forms Legal}},
title = {Personal Data Processing Consent Form (Ghana) (Ghana)},
year = {2026},
howpublished = {\url{https://forms-legal.com/ghana/personal/consent/data-processing-consent-form-ghana}},
note = {Free legal document template}
}Frequently Asked Questions
Section 17 of the Data Protection Act 2012 (Act 843) sets out the grounds on which personal data may lawfully be processed in Ghana. These grounds are: (1) Consent — the data subject has given their freely given, specific, and informed consent to the processing; (2) Contract — processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual steps taken at the data subject's request; (3) Legal obligation — processing is necessary to comply with a legal obligation to which the data controller is subject; (4) Vital interests — processing is necessary to protect the vital interests of the data subject; (5) Public task — processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; and (6) Legitimate interests — processing is necessary for the legitimate interests of the data controller or a third party, except where overridden by the interests or fundamental rights of the data subject. Data controllers registered with the Data Protection Commission in Ghana must identify and document the applicable lawful basis before commencing each processing activity.
Under Section 27 of the Data Protection Act 2012 (Act 843), every data controller in Ghana who processes personal data in the course of business or professional activity must register with the Data Protection Commission (DPC). Registration requires the submission of details about the data controller, the categories of personal data processed, the purposes of processing, and the security measures in place to protect the data. The DPC maintains a public register of data controllers. Failure to register is an offence under Act 843 and exposes the data controller to enforcement action, fines, and public censure. The DPC has published guidance on registration requirements and exemptions. Organisations that process only personal data of their own employees for human resource management purposes may qualify for a simplified registration procedure.
Consent obtained electronically is valid in Ghana for data processing purposes under the Data Protection Act 2012 (Act 843), provided it meets the substantive requirements of Section 17 of Act 843 — freely given, specific, informed, and unambiguous. The Electronic Transactions Act 2008 (Act 772) recognises electronic records and signatures as legally valid in Ghana, and electronic consent obtained through a tick-box on a website, a mobile application prompt, or an email confirmation process can satisfy the Act 843 requirements where the mechanism is designed to elicit a positive, affirmative act from the data subject. Pre-ticked boxes, implied consent, or silence are not sufficient. The data controller must be able to demonstrate that the specific consent was given — this means retaining electronic logs, timestamps, and the version of the consent notice displayed at the time of consent. For sensitive categories of data — including health data, biometric data, and Ghana Card numbers — organisations should obtain explicit written or electronic consent with additional verification steps.
Under the Data Protection Act 2012 (Act 843), data subjects in Ghana have the following principal rights against data controllers: (1) Right of access — the right to request and receive a copy of the personal data held about the data subject, and information about the purposes for which it is processed (Section 33 of Act 843); (2) Right to rectification — the right to require correction of inaccurate or incomplete personal data; (3) Right to erasure — the right to require deletion of personal data where the processing was unlawful, the data is no longer necessary for the original purpose, or consent has been withdrawn; (4) Right to object — the right to object to processing based on legitimate interests or for direct marketing purposes; (5) Right to withdraw consent — the right to withdraw consent at any time without detriment, where consent is the lawful basis for processing. Data subjects who believe their rights have been violated may file a complaint with the Data Protection Commission (DPC), which has powers to investigate, impose remediation requirements, and impose fines on data controllers found to be in breach of Act 843.
The Data Protection Act 2012 (Act 843) incorporates a storage limitation principle — personal data must not be retained for longer than is necessary for the purposes for which it was collected. Act 843 does not specify fixed retention periods for most categories of personal data, but data controllers registered with the Data Protection Commission (DPC) are expected to establish documented retention schedules that reflect the minimum necessary period. Sector-specific legislation may impose longer or shorter retention obligations — for example, the Anti-Money Laundering Act 2020 (Act 1044) requires banks licensed by the Bank of Ghana to retain KYC records for a minimum of five years after the termination of the customer relationship; the Labour Act 2003 (Act 651) implies retention of employment records during and for a reasonable period after employment. Where personal data is retained beyond the period consented to or necessary for the stated purpose, the data controller may be required to delete or anonymise the data upon request by the data subject or following a DPC investigation.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Data Protection Policy (Ghana)
A Data Protection Policy for organisations operating in Ghana, compliant with the Data Protection Act 2012 (Act 843) and Data Protection Commission requirements, covering data collection, processing, storage, security, and data subject rights.
Privacy Policy (Ghana)
A compliant Privacy Policy for businesses operating in Ghana disclosing data collection, processing, and user rights under the Data Protection Act 2012 (Act 843) and the Data Protection Commission (DPC).