Accra, Oct. 12, GNA – The Data Protection Commission (DPC) has intensified enforcement of Ghana’s data protection law, warning public and private institutions against processing personal information without fulfilling their legal obligations.
The Commission said it would step up spot checks, inspections, investigations into complaints and verification of registration status as part of its decision to make 2026 the year of enforcement.
Dr Arnold Kavaarpuo, Executive Director of the DPC, said at a media engagement in Accra on Monday that the exercise was intended to ensure that organisations collecting and processing personal information complied with the Data Protection Act, 2012 (Act 843).
He said the increasing misuse of personal information, particularly in the digital space, posed significant risks to individuals, businesses and public institutions.
“Every day, Ghanaians share sensitive information, including bank details, Ghana Card information, telephone numbers and medical records, with institutions to access essential services,” he said.
“However, when such information is mishandled, individuals may face financial losses, harassment, discrimination and reputational damage,” Dr Kavaarpuo.
He cited a report by the Cyber Security Authority indicating that nearly GH¢10 million was lost to online fraud in the first six months of 2026.
He said that although not all the losses could be attributed to data protection breaches, the figure highlighted the broader risks associated with the misuse of personal information.
Dr Kavaarpuo cautioned that advances in artificial intelligence (AI) had made it easier for fraudsters to combine personal information, photographs and voice recordings to create convincing impersonations for fraudulent activities.
The consequences of data protection failures extended beyond organisations’ computer systems, affecting individuals, their families and livelihoods, he said.
Dr Kavaarpuo said organisations were required by law to have lawful grounds for collecting personal information, use it for legitimate purposes and protect it against unauthorised access and misuse.
He explained that Section 56 of Act 843 made it an offence to process personal data without the required registration, punishable upon summary conviction by a fine, imprisonment for up to two years, or both.
The Act also provided for enforcement notices and other regulatory measures against non-compliant organisations.
Dr Kavaarpuo said the Commission would take appropriate action where violations were identified, including pursuing prosecution through the applicable legal processes where warranted.
He said the enforcement approach would be fair, professional and guided by due process, with compliance, rather than punishment for its own sake, as the primary objective.
He urged organisations to review their compliance status, register with the Commission where required, renew expired registrations and ensure that their internal procedures met the broader requirements of the law.
GNA
Edited by Agnes Boye-Doe
13 Oct. 2026
Reporter: Albert Oppong-Ansah
Email: [email protected]