The Data Protection Commission says 2026 will mark strict enforcement of the Data Protection Act, 2012 (Act 843), with sanctions for non-compliance.
Dr Arnold Kavaarpuo, Executive Director of the Data Protection Commission (DPC), said organisations and individuals who breached the law would face penalties, including fines and imprisonment.
He gave the warning on Monday at the launch of Data Protection Week 2026 in Accra, and said non-compliance with the Act would no longer be tolerated.
“Distinguished guests, ladies and gentlemen, whilst we are celebrating Data Protection Week, it is important to self-notice that 2026 will be a year of enforcement. The Act provides consequences for non-compliance when it comes to registration with the Commission,
“Clause 56 prescribes penalties and fines. That includes fines and imprisonment for people that actually fall under law. Our objective is not to punish for the sake of it. It is making sure that everybody can live confidently knowing that data is collected and processed with the right systems in place,” he said.
Data Protection Week 2026, which commenced on Monday, January 26, will culminate in a National Data Protection Conference in February.
It is on the theme: “Your Data, Your Identity: Building Trust in Ghana’s Digital Future.”
Dr Kavaarpuo announced that Mr Alban Sumana Kingsford Bagbin, Speaker of Parliament, would serve as Guest of Honour, underscoring Parliament’s commitment to compliance with Act 843.
He said the observance had been expanded into a month-long national programme in recognition of the growing importance of data protection in Ghana’s digital economy.
Dr Kavaarpuo noted that data protection now affected all aspects of daily life, including mobile money transactions, healthcare, education, telecommunications and digital public services.
He explained that the theme reflected how personal data extended beyond names and phone numbers to shape identity, access to opportunities, and trust.
Citing studies, Dr Kavaarpuo said a combination of location, date of birth and gender could identify an individual 87 per cent of the time, highlighting risks associated with emerging technologies such as artificial intelligence.
“When data is misused or poorly protected, it is not just systems that fail; people are affected,” he said.
Dr Kavaarpuo said the Commission continued to receive complaints involving unauthorised data sharing, digital loan fraud, financial distress, improper disclosure of health records and misuse of biometric information.
He added that some digital systems were deployed without Data Protection Impact Assessments, increasing risks to citizens and undermining public trust.
“These are not isolated incidents. They cut across financial services, telecommunications, education, and public digital services,” he said.
During an interaction with the media, Dr Kavaarpuo said selling personal data was illegal, even where individuals appeared to have provided their information voluntarily.
“The Data Protection Act does not allow anyone to sell personal data. Anyone actively selling personal data is in breach of Act 843,” he said.
He cautioned organisations, including political parties, against using personal data for marketing without informed consent, and said consent must be explicit and clearly understood.
Dr Kavaarpuo said Act 843 gave individuals ownership of their personal data, including the right to withdraw consent, correct inaccuracies, request deletion and transfer data between controllers.
He encouraged the public to exercise these rights and report breaches to the Commission.
Dr Kavaarpuo said in 2025 the Commission reached about 25 million people through public education and trained more than 800 data protection officers and professionals.
He said the Commission had introduced a digital registration and compliance platform, electronic verifiable certificates and a Data Protection Privacy Seal to recognise compliant institutions.
The first Privacy Seal was awarded to the O2FoR Foundation, a traditional institution, demonstrating that compliance was achievable for all entities, he said.
Dr Kavaarpuo appealed to the media to support education and accountability efforts.
“Privacy is not a privilege; it is a right, and protecting personal data is a shared responsibility,” he said.
Mr Emmanuel K. Gadasu, President of the Ghana Association of Privacy Professionals, described data protection as a cornerstone of modern citizenship.
He said digital identity influenced access to loans, employment, insurance and social services, and called on organisations, the media and citizens to play active roles in protecting personal data.
