Effective Monday, October 20th, the Commission will operate from its new premises at the former Information Services Department, located opposite the Accra City Campus of the University of Ghana. 

This strategic move is aimed at enhancing accessibility, improving service delivery, and ensuring closer engagement with the public and all relevant stakeholders in Ghana’s data protection ecosystem. 

All correspondence, official visits, and inquiries should henceforth be directed to the new address. Contact numbers, email addresses, and digital service platforms remain unchanged. 

The Commission appreciates the cooperation of the public and looks forward to continuing its mission of promoting and enforcing personal data protection in Ghana from its new location. 

For further information or directions, kindly visit our website at www.dataprotection.org.gh or call our hotline on 0256 301 533/0256301360. 

Source: Data Protection Commission

ALSO READ:

• Five firms apprehended for breaching data protection laws 

• Data Protection Commission warns public against online loan applications

The enforcement exercise is aimed at clamping down on businesses that have failed to register with the Data Protection Commission as data controllers but are processing personal data.

The enforcement exercise was supported by the Ghana Police Service.

The companies accosted were Care Flight Ghana, Embassy Court, Morning Star School, KABFAM and Grace Homeopathic Clinic. 

On the breach of section 17 of the Data Protection Act 2012 (Act 843) which requires all companies that manages personal data to acquire a license from the data Protection Commission, Morning Star School, Embassy Gardens, CareFlight Ghana and Grace Homeopathy were cited for breach.

Embassy Gardens and Morning Star School were also cited for non-registration with the commission.

Though Kabfam, one of the companies visited during the swoop had registered with the Commission, it was cited for failure to appoint a certified data protection supervisor.

Speaking to Joy Business after the exercise, Director of Regulatory and Compliance at the Data Protection Commission, Quintin Akrobeto, urged businesses to abide by the laws to avoid arrest.

“Registration is just one of the aspect of compliance. What we expect from institutions is to bring their activities under the radar of the commission for supervision.

For some of the companies, they haven’t registered at all. Even after several follow ups, they have failed to register with the commission. For those of them that have registered, they are still not compliant. You need to appoint a certified supervisor to help guide companies to compliance” he said.

The exercise is expected to be held monthly to ensure the utmost enforcement of the data protection laws.

ALSO READ:

• Data Protection Commission to clamp down on unregistered data controllers

• Companies without Data Protection Certs. risk losing license

The Commission began active enforcement last month, conducting spot checks, data protection audits and arresting companies found culpable of data breaches.

This activity, the Executive Director, Patricia Adusei-Poku, says has come to stay in order to hold accountable data controllers to ensure full compliance with the law.

“We the Data Protection Commission still consider that the percentage of public who are responsible for data controllers compared to what is in our database is still very low. We have over 800,000 records of active taxpayers that have failed to register with the commission.”

“This is why we have scaled up the law by doing these spot checks and visiting institutions that are falling foul of the requirement of this legal obligation”, she told an Accra-based television station.

She added that her outfit is undertaking this action in two ways, adding, “Many of these spot checks visits are to for the private sector to comply.

“We are not doing this to protect the public sector not taking action. We have also worked with the Select Committee of Communications in Parliament to ensure that institutions comply”.

The Data Protection Commission on August 14, 2023, began active enforcement of the Data Protection Act 2012 (Act 843).

This meant businesses that had failed to register with the Commission as Data Controllers but were processing personal data were liable to summary conviction to a fine or a term of imprisonment.

Falling under the radar for non-compliance included Hisense Group and Mawarko Fast Food out of many others on the compiled list for prosecution.

• Data Protection Commission warns public against online loan applications

• Fabewoso: Data Protection Commission revokes Bysystem license