Data Protection Act, 2012 — transfer of personal data to a foreign country

Personal data may be sent to a foreign country only where that country provides an adequate level of protection for data subjects' rights and freedoms, and the Data Protection Commission is the body that assesses adequacy — weighing the nature of the data, the purpose and duration of the proposed processing, the countries of origin and destination, the laws and professional rules in force in the receiving country, and whether any supervisory or judicial remedy is actually available to data subjects there. Ghana publishes no standing adequacy list, so the assessment is the exporter's to make and document, and it interacts with the Act's registration regime: the processing a controller registers with the Commission includes where data may be transferred. Marked 'check': the section numbering could not be pinned down against the primary text, and the adequacy factors above come from independent legal-reference summaries of the Act rather than a direct reading.