Data Protection Act, 2012

One of West Africa's earliest data-protection statutes. It applies to a data controller established in Ghana where the data is processed in Ghana, and to a controller not established in Ghana that uses equipment or a data processor located in Ghana for processing other than mere transit — an equipment-based test rather than a targeting test, so the trigger below is modeled on established presence only, and a foreign controller relying on Ghanaian infrastructure or a Ghanaian processor should check the second limb specifically. The defining operational duty is registration: data controllers must register with the Data Protection Commission and renew periodically, and processing without registration is itself an offence. A controller not established in Ghana but caught by the equipment limb must nominate a Ghana-based representative.