Who must register
The Data Protection Act, 2012 (Act 843) requires data controllers who intend to process personal data to register with the Data Protection Commission. Registration covers public bodies, companies, NGOs and sole traders alike; the Commission's fee tiers depend on the organisation's size and type.
Renewal and changes
Registration is renewed every two years. Notify the Commission of changes to the particulars registered, such as new purposes or new categories of data, rather than waiting for renewal. Processing personal data without registration is an offence under the Act.
Data protection supervisors
Act 843 allows a data controller to appoint a data protection supervisor, a qualified person who monitors the controller's compliance. The Commission encourages it, and for larger organisations it is the practical way to show accountability.
Breach notification
Section 31 requires the data controller, where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person, to notify the Commission and the data subject as soon as reasonably practicable after discovery. The Act sets no fixed number of hours; hlola uses 72 hours as a working outer limit for Ghanaian entities. See the Africa breach deadline comparison.
hlola tracks Ghana registration and renewal as controls under Act 843 in hlola.
Common questions
Is registration with the Data Protection Commission mandatory in Ghana?
Yes. Act 843 requires data controllers to register with the Data Protection Commission before processing personal data.
How often is DPC registration renewed?
Every two years.
How quickly must a breach be reported in Ghana?
As soon as reasonably practicable after discovery, to the Commission and the data subject, under section 31 of Act 843.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.