Data Protection Commission targets non-compliant institutions in 2026 crackdown

By Buertey Francis BORYOR

The Executive Director of the Data Protection Commission (DPC), Mr. Arnold Kavaapu?, has announced that 2026 will be a year of strict enforcement of Ghana’s Data Protection Act, warning that institutions processing personal data without registration and compliance will face sanctions.

Speaking at the Data Protection Week 2026 launch, and Meet-the-Press event in Accra, Mr. Kavaapuo said the law leaves no room for doubt, noting that Clause 27(1) of the Data Protection Act requires every data controller intending to process personal data to register with the Commission.

“The Data Protection Act is clear. Clause 27(1) provides that a data controller who intends to process personal data shall register with the Commission. This obligation is reinforced under Clauses 46(3) and 53, and the Act also prescribes penalties, including fines and imprisonment, under Clause 56”, he said.

He stressed that while enforcement will be firm, the objective is not punishment for its own sake but the protection of the rights of citizens and the building of trust in the country’s digital economy.

Also, he said that the Data Protection Week 2026 has been expanded into a month-long national programme, officially commencing on Monday, January 26, 2026, and ending with a conference on February 25 and 26 in Accra. The programme, he said, is dedicated to strengthening privacy, trust and responsible data use across the public and private sectors.

The national programme is being held under the theme, “Your Data, Your Identity: Building Trust in Ghana’s Digital Future.” According to the Executive Director, the theme reflects the growing reality that personal data now shapes identity, access, opportunity and trust in an increasingly digital society.

Highlighting progress made by the Commission, Mr. Kavaapuo said 2025 marked a significant year in strengthening its core mandate. He disclosed that the Commission delivered its largest public data protection awareness campaign since inception, reaching an estimated 25 million people nationwide through radio, print, billboards and digital platforms.

He said the Commission also expanded the registration of data controllers and processors through targeted sector engagements, conducted compliance audits across key public and private institutions, and supported the training of more than 800 data protection officers and professionals nationwide.

Beyond awareness and enforcement, he said it invested in modernising its regulatory infrastructure. This included the deployment of a new digital registration and compliance platform, the introduction of the Data Protection Privacy Seal as a visible mark of trust, and the rollout of electronic, verifiable certificates that allow real-time confirmation of compliance status. Mr. Kavaapuo said these reforms align with government’s reset agenda.

Government backs sustained public education and compliance

Deputy Minister of Communications, Digital Technology and Innovations, Mohammed Adam Sukparu, in a keynote speech at the event said, the decision to expand Data Protection Week into a month-long national programme, culminating in a National Data Protection Conference in February, reflects government’s acknowledgement that data protection must evolve alongside the country’s digital transformation.

He noted that country continues to invest heavily in digital identity systems, mobile money, e-government services and emerging technologies, and stressed that these investments can only yield results if citizens trust that their data is handled lawfully, securely and responsibly.

He assured stakeholders of government’s continued support for the Data Protection Commission in strengthening compliance across the public and private sectors, while encouraging institutions to work closely with the Commission to uphold the principles of Act 843.

He described that campaign as the largest public awareness initiative on data protection since the establishment of the Commission, noting that it successfully took privacy conversations beyond policy circles into the daily lives of the citizenry through radio, television, print and digital platforms.

Professionals push ethics, trust and capacity building

President of the Ghana Association of Privacy Professionals, Mr. Emmanuel K. Gadasu, in remarks at the event also said, the 2026 theme is a direct call to action at a time when digital identity increasingly determines access to loans, insurance, employment and social services.

He explained that in today’s digital economy, identity is shaped not only by official documents but also by mobile money transaction histories, health records, location data and online behaviour. When such data is misused or compromised, he said, it becomes more than a privacy breach and strikes at personal autonomy and economic participation.

Mr. Gadasu stressed that trust is non-negotiable if the country is to build a secure and inclusive digital future. He highlighted the critical role of Data Protection Officers and privacy professionals, describing them as ethical guardians and frontline protectors of public trust within organisations.

He called on organisations to invest in their Data Protection Officers, the media to hold institutions accountable through responsible reporting, the judiciary to deepen engagement with data protection law, and citizens to take ownership of their personal data rights.

The post Data Protection Commission targets non-compliant institutions in 2026 crackdown appeared first on The Business & Financial Times.

Read Full Story