GUIDE · Privacy and Data Protection
Privacy Programs That Satisfy Regulators and Earn Customer Trust.
We build privacy governance from policy to daily practice, aligned with Act 843, GDPR and HIPAA.
- Demonstrable compliance with data protection law
- Lower breach exposure
- Customer trust in data handling
- 1Discover Personal Data
- 2Establish Lawful Basis
- 3Map Controls to Risks
- 4Test and Evidence
- 5Monitor and Refresh
Executive Summary
- 01Privacy compliance starts with knowing what personal data exists, why it is processed and where it travels.
- 02Every legal obligation should map to a control that someone owns and a test that produces evidence.
- 03Cross-border transfers and vendor flows need a living register, because they change whenever a system or supplier changes.
The Challenge
Data protection laws are multiplying across Africa and the Gulf, and cross‑border data flows add complexity.
Organizations often lack a clear inventory of personal data, the lawful basis for processing it and the controls to protect it.
The DAAKYI Approach
DAAKYI assesses privacy maturity, designs governance and policy, and links privacy requirements to the security controls that enforce them.
Cross-border data governance is addressed explicitly for multi-country operators.
- 01
Privacy maturity and risk assessment
- 02
Governance and policy design
- 03
Data inventory and processing records
- 04
Privacy awareness
In Depth
How the Discipline Works
Start with the Data, Not the Policy
Privacy work fails when it begins with a policy template. It works when it begins with an inventory of personal data: what is collected, from whom, where it lives, who can reach it and which vendors receive copies. Each processing activity then gets a purpose and a lawful basis. Under Ghana's Act 843, that means testing activities against the eight principles, including specification of purpose and compatibility of further processing. Under GDPR, it means a documented basis for every activity. The result is a record that legal, security and business teams all read the same way, and a regulator can follow.
Turn Obligations into Enforceable Controls
A privacy requirement that no control enforces is only a statement of intent. Each obligation should map to a mechanism. Data minimization maps to collection limits in forms and APIs. Retention rules map to automated deletion jobs. Data security safeguards map to encryption, access control and logging. HIPAA's Security Rule expects administrative, physical and technical safeguards for electronic protected health information, so the mapping must cover all three types. ISO/IEC 27001 Annex A and ISO/IEC 27002 supply a shared control vocabulary. When privacy and security teams use one control catalog, evidence is collected once and reused across audits instead of being rebuilt for each regulator.
Govern Cross‑Border and Vendor Flows
Personal data rarely stays in one country. Cloud regions, support desks, analytics tools and group affiliates all create transfers. A transfer register lists each flow, the sending and receiving entity, the legal mechanism relied on and the safeguards applied. Vendor flows need the same discipline: a processor contract, a security review and a right to audit. Registers must be refreshed when a system changes, because a new SaaS integration can create an unlisted transfer overnight. Breach duties add urgency. GDPR expects notification of the supervisory authority within 72 hours where feasible, so teams need to know in advance which regulator receives which notice.
A privacy policy states intent. A data inventory, enforced controls and tested evidence prove it.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Privacy Maturity Assessment | Current position and priority gaps. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
| Governance and Policy | Roles, policies and processing records. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
| Cross‑Border Data Governance | Transfers mapped and controlled. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
| Privacy Awareness | Staff understand their obligations. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
Privacy Maturity Assessment
Current position and priority gaps.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
Governance and Policy
Roles, policies and processing records.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
Cross‑Border Data Governance
Transfers mapped and controlled.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
Privacy Awareness
Staff understand their obligations.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
How It Works
How Privacy and Data Protection Works
- 01Assess
- 02Govern
- 03Engineer
- 04Operate
Methodology
The Method, Step by Step
- 1
Discover Personal Data
Identify systems, files, vendors and business processes that handle personal data. Use interviews, data discovery tooling and system documentation together, because each alone misses something. Classify special categories such as health and financial data separately. Record owners for every dataset so questions about purpose and retention reach someone accountable.
- 2
Establish Lawful Basis
For each processing activity, document the purpose, the lawful basis and the data subjects affected. Test whether later uses are compatible with the original purpose. Flag activities with high risk, such as profiling or large-scale health data processing, for a deeper impact assessment before they continue or expand.
- 3
Map Controls to Risks
Link each obligation to a technical or procedural control: encryption, role-based access, masking, retention automation, consent capture or vendor review. Rate residual risk using a consistent method such as ISO 31000. Record accepted risks with a named owner and a review date.
- 4
Test and Evidence
Verify that controls work as described. Sample access rights, confirm deletion actually occurs, run a breach notification exercise and check that vendor contracts contain the required clauses. Store results as dated evidence so an auditor or regulator can reproduce the conclusion.
- 5
Monitor and Refresh
Privacy drifts as products change. Trigger a review when a new system, vendor, country or data type is introduced. Track measures such as request handling, overdue retention actions and open vendor findings. Report them to the accountable executive on a fixed cycle.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Engagement model
Project Implementation
Design and deployment of security technologies.
Best for · Modernization and transformation
Threat Scenarios
What It Looks Like in Practice
Unlisted Vendor Receives Personal Data
How It Shows Up
A marketing team connects a new analytics tool to the customer database. Nobody updates the transfer register or reviews the vendor contract.
Response
A change trigger forces privacy review before any new integration goes live. The register, contract and safeguards are updated together.
Breach Involving Personal Data
How It Shows Up
Security detects unusual bulk reads of customer records. Legal asks whether regulators and affected individuals must be told, and the GDPR 72-hour window is already running.
Response
A rehearsed breach playbook defines severity tests, decision owners and notice templates per regulator. The privacy lead and incident team work from the same timeline.
Access Request Overwhelms the Team
How It Shows Up
A data subject asks for all records held about them. Staff cannot say which systems hold the data, so responses are slow and incomplete.
Response
The data inventory identifies every system holding personal data and its owner. A defined request procedure covers identity checks, search, review and response.
Data Reused Beyond Its Original Purpose
How It Shows Up
An analytics or AI team wants to train models on customer records collected for service delivery.
Response
A compatibility assessment tests the new use against the original purpose and lawful basis. High-risk uses get an impact assessment, and approved uses get minimization or pseudonymization controls.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Unlisted Vendor Receives Personal Data | A marketing team connects a new analytics tool to the customer database. Nobody updates the transfer register or reviews the vendor contract. | A change trigger forces privacy review before any new integration goes live. The register, contract and safeguards are updated together. |
| Breach Involving Personal Data | Security detects unusual bulk reads of customer records. Legal asks whether regulators and affected individuals must be told, and the GDPR 72-hour window is already running. | A rehearsed breach playbook defines severity tests, decision owners and notice templates per regulator. The privacy lead and incident team work from the same timeline. |
| Access Request Overwhelms the Team | A data subject asks for all records held about them. Staff cannot say which systems hold the data, so responses are slow and incomplete. | The data inventory identifies every system holding personal data and its owner. A defined request procedure covers identity checks, search, review and response. |
| Data Reused Beyond Its Original Purpose | An analytics or AI team wants to train models on customer records collected for service delivery. | A compatibility assessment tests the new use against the original purpose and lawful basis. High-risk uses get an impact assessment, and approved uses get minimization or pseudonymization controls. |
Outcomes
What Your Institution Gains
- Demonstrable compliance with data protection law
- Lower breach exposure
- Customer trust in data handling
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Personal Data Inventory | Shows what personal data exists, where it is stored, who owns it and who receives it. |
| Record of Processing Activities | Documents purpose, lawful basis, categories of data and retention for each activity. |
| Cross‑Border Transfer Register | Tracks each international flow with its legal mechanism and safeguards. |
| Privacy Impact Assessment | Evaluates high-risk processing and sets conditions before it proceeds. |
| Breach Notification Playbook | Defines who decides, who notifies and which regulator receives which notice. |
| Role | Responsibility |
|---|---|
| Data Protection Officer or Privacy Lead | Owns the processing records, advises on lawful basis and acts as the point of contact for regulators and data subjects. |
| Chief Information Security Officer | Ensures security controls enforce privacy requirements and that incident response covers personal data breaches. |
| Business Data Owner | Decides purpose and retention for a dataset and approves who may access it. |
| Privacy Engineer (Provider or Client Side) | Builds discovery, masking, retention and consent mechanisms into systems and pipelines. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Privacy depends on individual awareness. There is no complete inventory, and breach and request handling are improvised.
Stage 2
Documented
Policies, roles and processing records exist. Enforcement relies on manual effort and the records age quickly.
Stage 3
Enforced
Controls implement the policies: automated retention, access reviews and vendor checks. Changes trigger privacy review.
Stage 4
Measured and Assured
Metrics and independent testing show the controls work. Leadership sees privacy risk reported alongside security risk.
Frameworks and Regulation
The Standards That Shape This Work
Ghana Data Protection Act, 2012 (Act 843)
Established the Data Protection Commission and requires data controllers to register. Its eight principles, from accountability to data subject participation, form a practical test for each processing activity.
GDPR
Requires a lawful basis for processing and notification of the supervisory authority of a personal-data breach within 72 hours where feasible, unless the breach is unlikely to result in risk.
ISO/IEC 27701
Specifies requirements for a privacy information management system. It extends the information security management approach of ISO/IEC 27001 to cover personal data processing.
NIST CSF 2.0
Its Govern function helps place privacy risk within enterprise risk management. Identify and Protect support the inventory and safeguard work.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for a provider that begins with data discovery and processing records, not a policy rewrite.
- Look for clear mapping from each legal obligation to a named control and a type of evidence.
- Look for experience across the regimes you operate under, including Act 843, GDPR and sector rules.
- Look for a plan to keep registers current after the engagement ends.
Questions to ask a provider
- How do you discover personal data in unstructured sources such as email and scanned documents?
- How will you show that a control satisfies a specific legal obligation?
- How do you handle conflicts between the requirements of different countries?
- What will our team own and maintain once the assessment is complete?
Regulatory & Industry Context
The Obligations This Service Supports
Programs address Ghana's Act 843, GDPR, HIPAA, the Nigeria Data Protection Act and ISO/IEC 27701.
Frameworks DAAKYI helps clients implement
- Ghana Act 843
- GDPR
- HIPAA
- Nigeria Data Protection Act
- ISO/IEC 27701
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- Ghana Act 843
- GDPR
- HIPAA
- Nigeria Data Protection Act
- ISO/IEC 27701
Programs address Ghana's Act 843, GDPR, HIPAA, the Nigeria Data Protection Act and ISO/IEC 27701.
Architecture reference
How Privacy and Data Protection Works: Assess → Govern → Engineer → Operate.
DAAKYI assesses privacy maturity, designs governance and policy, and links privacy requirements to the security controls that enforce them.
Data Discovery and Classification Engineering
Automated discovery scans databases, object storage, file shares and SaaS repositories for patterns such as national ID numbers, phone numbers, account numbers and health identifiers. Pattern matching alone creates false positives, so tune with validation checks, such as checksum logic where an identifier supports it, and with column-name context. Unstructured data such as scanned forms and email attachments needs content inspection and sampling. Feed results into a catalog that tags each dataset with sensitivity, owner and retention class. Those tags then drive policy: encryption requirements, access reviews, data loss prevention rules and deletion schedules. Rerun scans on a schedule, because shadow copies in test environments and exports are a frequent source of untracked personal data.
Encryption, Tokenization and Key Custody
Encryption protects data at rest and in transit, but privacy engineering goes further. Use envelope encryption with keys held in a managed key service or hardware security module, separate key custody from data administrators, and rotate keys on a defined schedule. Apply field-level encryption or tokenization to high-risk attributes so that analytics and test environments never see raw values. Pseudonymization replaces identifiers with tokens while a separately protected mapping allows re-identification; it reduces risk but the data remains personal data under GDPR. Log every access to the mapping table and alert on bulk reads. Deletion should cover backups through key destruction or documented expiry.
Glossary
Key Terms
- Lawful Basis
- The legal justification, such as consent, contract or legal obligation, that permits an organization to process personal data.
- Data Controller
- The party that decides why and how personal data is processed, and that carries primary accountability.
- Data Subject Access Request
- A request from an individual to see the personal data an organization holds about them.
- Pseudonymization
- Replacing direct identifiers with tokens so data cannot be attributed to a person without separately held information.
Related
Explore Connected Capabilities
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Privacy and Data Protection
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Privacy and Data Protection with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Privacy and Data Protection will respond.
Talk to a Cybersecurity Expert