DPC to sanction non-compliant institutions

By Buertey Francis BORYOR

The Data Protection Commission (DPC) has warned that 2026 will mark the start of a full-scale enforcement drive, with public and private institutions which process personal data without registration facing fines and possible imprisonment.

Executive Director of the Commission Arnold Kavaapu? said there will be no exemptions, stressing that the law clearly mandates registration and compliance under the Data Protection Act, 2012 (Act 843).

Speaking at the launch of Data Protection Week 2026 and a Meet-the-Press briefing in Accra, Mr. Kavaapu? said institutions operating outside the law should expect sanctions.

“Clause 27(1) requires every data controller intending to process personal data to register with the Commission. This obligation is reinforced under Clauses 46(3) and 53, with penalties including fines and imprisonment prescribed under Clause 56,” he said.

He said the enforcement drive is aimed at protecting citizens’ rights and strengthening trust in the country’s digital economy, rather than punitive action alone.

Mr. Kavaapu? announced that Data Protection Week 2026 has been expanded into a month-long national programme running from January 26 and culminating in a National Data Protection Conference on February 25 and 26 in Accra, under the theme ‘Your data, your identity: Building trust in Ghana’s digital future’.

He said the Commission made significant regulatory gains in 2025, including its largest nationwide public awareness campaign – which reached an estimated 25 million people, expanded registration of data controllers, compliance audits across key sectors and saw the training of more than 800 data protection officers.

The Commission also rolled out a digital registration and compliance platform, introduced the Data Protection Privacy Seal and deployed electronic, verifiable certificates to enable real-time confirmation of compliance.

Government backs tougher enforcement

Deputy Minister of Communications, Digital Technology and Innovations, Mr Mohammed Adam Sukparu, said government fully supports the Commission’s enforcement stance – noting that trust in data-handling is critical as Ghana deepens investments in digital identity, mobile money and e-government systems.

He urged institutions to work closely with the DPC to comply with Act 843.

Privacy professionals warn of trust deficit

President of the Ghana Association of Privacy Professionals, Emmanuel K. Gadasu, said trust is non-negotiable in a digital economy where personal data increasingly determines access to finance, jobs and public services.

He warned that misuse of data undermines personal autonomy and economic participation – calling on organisations to invest in data protection capacity, the media to enforce accountability and citizens to assert their data rights.

The post DPC to sanction non-compliant institutions appeared first on The Business & Financial Times.

Read Full Story