Data Residency in Ghana: What Act 843 Means for Your Cloud Choices

This article is general information, not legal advice. Check the official sources or speak to a qualified lawyer for your situation.

Ghana's main data protection law is the Data Protection Act, 2012 (Act 843). It is enforced by the Data Protection Commission (DPC). If your organisation is choosing where to host systems that hold personal data, Act 843 shapes that decision in three ways: you must register, you must follow the data protection principles including security duties, and you must describe where personal data may be transferred. This guide explains each in plain English and links to the official text.

Does Act 843 Apply to Our Organisation?

Act 843 applies to organisations that process personal data, which the Act calls data controllers, and to processors working on their behalf. The Data Protection Commission states that data controllers and processors must register with it (DPC registration). If your organisation collects information about customers, staff, patients or citizens, it is very likely in scope.

How Does DPC Registration Work?

Registration is made to the Commission, online through the DPC registration portal. Under section 47 of the Act, the application describes, among other things, the personal data held, the purposes it is processed for, who it may be disclosed to, the countries to which it may be transferred, and a general description of the security measures in place (Act 843, s.47). Under section 50, registration must be renewed every two years (Act 843, s.50).

For cloud decisions, the important point is that your registration has to describe your data flows accurately. If you move a system to a provider in another country, that is information the registration asks for.

What Are the Data Protection Principles?

Act 843 sets out principles that every data controller must follow. The Commission summarises them as accountability, lawfulness of processing, specification of purpose, compatibility of further processing with the purpose of collection, quality of information, openness, data security safeguards and data subject participation (Data Protection Commission; Act 843).

In everyday terms: know why you hold each kind of personal data, keep it accurate, be open with the people it concerns, let them exercise their rights, and protect it properly. Each of these applies wherever the data is hosted.

What Security Duties Does Act 843 Set?

Section 28 requires a data controller to take appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal data, and unlawful access to or processing of it (Act 843, s.28). The controller must identify foreseeable internal and external risks, put safeguards in place, check regularly that they work, and update them as risks change. The Act also expects controllers to observe generally accepted information security practices.

When you use a cloud provider, these duties stay with you as the data controller. You need to know how the provider protects your data, and be able to show it.

Does Ghana Law Require Data to Be Hosted in Ghana?

Act 843, as it stands, does not contain a general rule that all personal data must be stored inside Ghana. What it does require is that you describe, at registration, the countries to which personal data may be transferred (Act 843, s.47), and that you protect the data wherever it is processed. Sector regulators may set their own rules for their sectors, so check with yours.

Proposals to update Ghana's data protection law have been discussed publicly, including a Data Protection Bill in 2025. A bill is only a proposal: it is not law and not in force unless Parliament passes it and it takes effect. This guide reflects Act 843 as currently enacted.

What Does This Mean for Our Cloud Choices?

• Map your data first. List the systems that hold personal data and where each one runs today, including backups and logs.
• Keep your registration accurate. If a system moves to a provider in another country, make sure your DPC registration describes that transfer.
• Check the security you can evidence. Section 28 duties stay with you; ask providers for clear answers on access, encryption, monitoring and incident handling.
• Consider in-jurisdiction hosting for the most sensitive data. It is not a general legal requirement under Act 843, but it can make data flows simpler to describe and evidence.
• Plan for change. Watch for updates from the Data Protection Commission and your sector regulator.

What Should Different Organisations Do First?

Banks and other regulated firms should check that their DPC registration matches their current systems and providers, and confirm whether their sector regulator has its own expectations on hosting and outsourcing. Keep the evidence of security measures ready, because the registration itself asks for a general description of them.

Government and critical infrastructure organisations often hold large volumes of personal data about citizens. Start with a data map of registers and service systems, confirm who acts as the data controller for each, and make sure transfers to any provider outside Ghana are described at registration. Requirements that apply to critical information infrastructure come from the Cyber Security Authority under Act 1038, so check those separately.

Growing mid-sized businesses may be registering for the first time. The DPC portal is the starting point. List the personal data you hold, the cloud and software providers you use and the countries they operate from, and the security measures you rely on. That list answers most of what registration asks and is useful for your own security planning.

A Practical Checklist for Each Audience

None of these steps assumes that Ghana requires personal data to be hosted in the country. They help you show where your data is and how it is protected.

Banks and other regulated firms

• Confirm that your registration with the Data Protection Commission is current and reflects the systems and providers you use today.
• Record the countries in which each provider stores or processes personal data.
• Check your sector regulator's own rules on hosting and outsourcing separately from Act 843.
• Keep evidence of your security measures ready for audits and examinations.

Government and critical infrastructure organisations

• Name the data controller for each register and service system.
• Document where personal data is stored and whether it leaves Ghana, and why.
• Check with the Cyber Security Authority whether any system falls under the critical information infrastructure provisions of Act 1038.
• Plan how citizens' data is returned or deleted if a provider contract ends.

Growing mid-sized businesses

• If you have not registered yet, start on the DPC online registration portal.
• Write down the personal data you hold, why you hold it and who can see it.
• Ask each cloud and software provider where data is hosted and which security measures they apply.
• Set a yearly date to review this list alongside your registration details.

How Does This Relate to the Cybersecurity Act?

Act 843 covers personal data. The separate Cybersecurity Act, 2020 (Act 1038) is administered by the Cyber Security Authority and covers matters such as critical information infrastructure and the licensing of cybersecurity service providers. Organisations in regulated sectors often need to consider both.

Where Can DAAKYI Help?

DAAKYI's privacy and data protection team helps organisations map personal data and prepare documentation, and cloud security engineering designs hosting that matches your obligations. For hosting in jurisdiction, see DAAKYI Cloud and the hosting details on daakyicloud.com. For the broader trade-offs, read sovereign cloud vs public cloud for regulated organisations in Africa.

Official Sources

• Data Protection Act, 2012 (Act 843), full text (GhaLII)
• Data Protection Act, 2012 (Act 843), PDF published by the Cyber Security Authority
• Data Protection Commission and DPC registration information
• DPC online registration portal