Is Your Website Compliant with Ghana's Data Protection Act? A Practical Guide for Businesses
Is your website compliant with Ghana's Data Protection Act? A practical guide to DPC registration, privacy notices, cookies, contact forms, security and rights.
Key points
- Any website that collects personal data, even through a simple contact form, brings your business under the Data Protection Act, 2012 (Act 843).
- Section 27 requires data controllers to register with the Data Protection Commission, and section 50 says registration must be renewed every two years.
- Section 27(2) lists what people must be told when you collect their data, which is the backbone of a good privacy notice.
- Collect only what you need, keep it only as long as necessary and protect it with appropriate technical and organisational measures.
- People can ask to see, correct or delete their data, and access requests must be answered within 40 days.
Your website must comply with Ghana’s Data Protection Act if it collects personal data, such as names, emails or phone numbers from a contact form. In practice that means registering with the Data Protection Commission, publishing a clear privacy notice, collecting only what you need, keeping it secure and deleting it when you no longer need it. You must also respond when people ask to see or correct their data.
This guide covers each area with the relevant section of the Data Protection Act, 2012 (Act 843). Every section reference below has been checked against the text of the Act. It is not legal advice. Confirm your obligations with the Data Protection Commission or a lawyer.
Does the Data Protection Act apply to my website?
Almost certainly, if your website collects anything that identifies a person. The Act defines personal data as data about an individual who can be identified from that data, or from it combined with other information you hold or are likely to hold.
“Processing” is defined just as broadly. It includes collecting, storing, using, disclosing and deleting data. A contact form, newsletter sign-up, online shop, booking system or job application page all involve processing.
Section 45 says the Act applies where the controller is established in Ghana and processes data here. It also applies where a foreign controller uses equipment or a processor in Ghana, or processes information that originates in Ghana.
Website compliance with the Data Protection Act at a glance
| Area | What the Act says | What to do on your website |
|---|---|---|
| Registration | s.27(1), s.53, s.50 | Register with the DPC and renew every two years |
| Telling people | s.23, s.27(2) | Publish a privacy notice and link it from every form |
| Consent | s.20 | Ask before optional uses such as marketing or analytics |
| Minimality | s.19, s.22 | Only ask for fields you genuinely need |
| Retention | s.24 | Set deletion periods for form entries and accounts |
| Security | s.28, s.30 | HTTPS, updates, access control and processor contracts |
| Breaches | s.31 | Notify the DPC and affected people |
| Rights | s.32, s.33, s.35, s.39, s.40 | Give people a way to ask for access, correction or deletion |
Do I need to register with the Data Protection Commission?
Section 27(1) says a data controller who intends to process personal data “shall register with the Commission”. Section 53 adds that an unregistered data controller must not process personal data. The DPC’s website states that all data controllers and processors must register.
Failing to register while processing personal data is an offence under section 56. The penalty is a fine of up to 250 penalty units, up to two years’ imprisonment, or both.
When you apply, section 47 asks for details such as:
- your business name and address
- the personal data you process and whose data it is
- whether you hold special personal data, such as health information
- why you process it and who you disclose it to
- any country you may transfer it to
- a general description of your security measures
Registration must be renewed every two years (section 50). You must notify the Commission of changes to your registered details within 14 days (section 55). The DPC told the Ghana News Agency in October 2026 that it is combining registration with spot checks and inspections.
What should a website privacy notice include?
Section 23 says you must make people aware of the purpose for collecting their data. Section 27(2) goes further. Before collection, people should be aware of:
- the nature of the data being collected
- the name and address of the person responsible for collecting it
- the purpose of the collection
- whether supplying the data is optional or mandatory
- the consequences of not providing it
- any legal requirement for the collection
- who will receive the data
- the nature or category of the data
- their right to access and correct it
A privacy notice that covers these nine points is a strong start. Link it from your footer and next to every form. Write it in plain English and keep it specific to what your site actually does. The DPC’s own privacy policy is a useful example of the format.
Do Ghanaian websites need cookie consent?
The Act does not mention cookies by name. We could not find specific cookie guidance from the DPC. However, cookies and similar tools often collect data that can identify a visitor, such as device identifiers linked to an account.
Section 20 requires prior consent unless another justification applies, such as a contract or a legitimate interest. Strictly necessary cookies, like a shopping basket, are easier to justify. Analytics, advertising pixels and retargeting are harder.
A practical approach is to:
- list the cookies and third-party tools your site uses
- load non-essential trackers only after a visitor agrees
- explain cookies in your privacy notice
- let visitors change their choice later
If you serve visitors in other countries, their local laws may also apply. Check with a lawyer if that is a big part of your audience.
How should contact forms and stored data be handled?
Ask only for what you need
Section 19 says personal data may only be processed if the purpose is “necessary, relevant and not excessive”. Section 22 says the purpose must be specific and lawful. A general enquiry form rarely needs a date of birth or home address.
Be careful with sensitive data
Section 37 restricts processing of special personal data. This includes health, religious beliefs, ethnic origin and data about children under parental control. Clinics, schools and churches should take extra care with forms that capture these details.
Set retention periods
Section 24 says you must not keep personal data longer than necessary for its purpose, unless an exception applies, such as a legal requirement. When the period ends, you must destroy, delete or de-identify the record in a way that prevents it being reconstructed.
Many websites quietly store every form submission forever in a database or inbox. Decide how long you need enquiries, then delete them on a schedule.
What security measures does the Act require?
Section 28 requires “appropriate, reasonable, technical and organisational measures” to prevent loss, damage and unauthorised access. You must identify foreseeable risks, put safeguards in place, check them regularly and update them as risks change.
For a typical business website, that includes:
- HTTPS on every page
- keeping the CMS, plugins and server software updated
- strong passwords and multi-factor authentication for admin accounts
- limiting who can see form submissions
- regular, tested backups
Hosting providers and other processors
Your hosting company, email platform and form tools are likely to be data processors. Section 30 requires a written contract with each processor that obliges them to keep the data confidential and secure. Where a processor is not based in Ghana, section 30(4) says you must ensure it complies with Ghanaian law.
Data breaches
If you have reasonable grounds to believe personal data has been accessed by an unauthorised person, section 31 requires you to notify the Commission and the affected people as soon as reasonably practicable.
What rights do website visitors have?
People whose data you hold have several rights under the Act:
- Access (sections 32 and 35): to know what data you hold, why, and who receives it. Section 35(10) says you must respond promptly and within 40 days.
- Correction and deletion (section 33): to correct or delete data that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained.
- Objection (sections 20 and 39): to object to processing, including processing that causes unwarranted damage or distress.
- Direct marketing (section 40): to stop marketing at any time. Our guide to bulk SMS and WhatsApp marketing in Ghana covers this in detail.
Give people a clear email address or form for these requests, and record how you handled each one.
What about storing data outside Ghana?
Many websites use hosting, email or analytics services located abroad. The Act does not set out a detailed cross-border transfer regime of the kind found in some other countries. It does contain relevant duties:
- Section 47(1)(g) asks you to name, in your registration, any country to which you may transfer data.
- Section 30(4) says you must ensure a processor based outside Ghana complies with Ghanaian law.
- Section 18(2) covers data about foreign data subjects sent into Ghana for processing, which must comply with the law of their home jurisdiction.
Know where your website data is stored, list those locations in your registration, and choose providers that offer written data processing terms.
Frequently asked questions
Does a small business website with just a contact form need to register?
Section 27(1) applies to any data controller who intends to process personal data, and the Act does not set a size threshold. A contact form collects personal data, so registration is likely to apply. Confirm with the DPC.
Is a privacy policy legally required in Ghana?
The Act does not use the term “privacy policy”. It does require you to make people aware of specific information before you collect their data (section 27(2)). A website privacy notice is the most practical way to do that.
How long can I keep contact form submissions?
No longer than necessary for the purpose you collected them for, unless an exception in section 24 applies. Set a period that fits your business and delete old entries regularly.
What happens if my website is hacked?
Contain the incident, restore from clean backups and assess what data was exposed. Section 31 requires you to notify the Commission and affected people as soon as reasonably practicable.
Make compliance part of your website
Data protection is easier to build in than bolt on. Our website design and development team can build privacy notices, consent-aware forms and sensible retention into your site. Our IT support and cloud service can help with security, backups and processor set-up. Contact us to talk it through.