Privacy Policy and Website Terms Generator

What a privacy policy must tell people in Ghana

Section 27(2) of the Data Protection Act, 2012 (Act 843) lists what a data controller must make sure people know when it collects their personal data. A website privacy policy is the usual way to do this. People should know:

• what kind of data is being collected;
• the name and address of whoever is collecting it;
• why it is needed;
• whether giving it is optional or required, and what happens if they don’t;
• any law that requires or authorises the collection;
• who will receive the data;
• that they have the right to access the data and ask for it to be corrected.

The Act’s other principles shape the rest of the policy: collect only what is necessary, relevant and not excessive (section 19); keep it no longer than needed and then delete or de-identify it (section 24); protect it with appropriate technical and organisational measures (section 28); and tell the Commission and the people affected about unauthorised access as soon as reasonably practicable (section 31). The generator turns your answers into sections that cover each of these points.

Registration comes first

Under the Act, a data controller (the business that decides why and how personal data is used) must register with the Data Protection Commission before processing personal data. The registration asks for many of the same details as your privacy policy, including the data you process, why, who receives it, the countries you may transfer it to and how you secure it (section 47). Registration must be renewed every two years (section 50), and changes to your details must be reported within 14 days (section 55). The Commission’s website, dpc.gov.gh, explains how to register and renew.

If you tell the generator that you are not registered yet, it adds a warning and a note to the policy instead of a registration statement.

How to use the documents

1. Answer honestly. Tick only what your website and business really do. A policy that promises things you don’t do is worse than none.
2. Read the highlighted notes. “[Check with a lawyer: …]” marks a legal point to review. “[Check: …]” marks a fact only you can confirm, such as what your hosting provider records.
3. Edit on the page. Change any wording to fit your business. Downloads and copies use your edited text.
4. Remove every note once it is resolved, then publish the policy on its own page and link to it from your footer and from every form that collects personal data.
5. Review it regularly, for example whenever you add a new form, analytics tool or service provider.

Ghana or general?

The Ghana option names the Act and the Commission, lists the rights the Act gives people and quotes the response times it sets (40 days for access requests and 21 days for a notice to stop processing). The general option is for websites elsewhere, or for anyone who wants neutral wording. It describes common good practice and adds notes where the law of your country may require more, but it makes no claims about any specific law.

What the terms of use cover

The terms explain who runs the website, what visitors may and may not do, who owns the content, how accounts and user posts work (if you have them), the limits of your responsibility, and which country’s law applies. If you sell online, write separate terms of sale as well.

Getting help

Putting a policy online is only part of handling data well. Secure forms, sensible cookie settings and backups matter too. Our website design and development and IT support and cloud teams can help. Planning a new site? Start with the website requirements generator, and if you sell online, check the online store readiness checker.