Ghana Data Protection Act

Ghana Data Protection Act - DPC registration, data subject rights, consent, security safeguards.


Short name	GH DPA
Region	Middle East & Africa
Country or scope	Ghana
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers GH DPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for GH DPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for GH DPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`GH-DPA-SEC` Security Measures	A data controller must take appropriate technical and organisational measures to prevent loss, damage, or unauthorised destruction of personal data, which presupposes integrity controls over the processing systems and software in use (Act 843, security-measures obligation, s.28)	Scan
`GH-DPA-REG` Registration and Accountability	Data controllers must register with the Data Protection Commission and remain accountable for the processing they carry out, which requires an identified, documented account of the systems and software assets that process personal data (Act 843, registration of data controllers provisions)	Scan
`GH-DPA-INV` Accountability for Processing Systems	The accountability principle requires a data controller to be able to demonstrate what processing occurs under its control, which is only possible if the software components making up its processing systems are enumerated (Act 843, data protection principles, s.17-18)	Scan
`GH-DPA-PROC` Data Processor Safeguards	Where processing is carried out by a data processor on behalf of a controller, the controller must ensure the processor provides sufficient safeguards, which requires knowing who supplies each part of the processing stack (Act 843, processing-by-processor obligation, s.30)	Scan
`GH-DPA-QLTY` Quality and Completeness of Records	Personal data and the records describing processing must be complete, accurate, and kept up to date; applied to the software inventory this means every component record carries both a name and a version (Act 843, data quality obligation)	Scan
`GH-DPA-BREACH` Security Breach Response Readiness	A controller must notify the Commission and affected data subjects where there are reasonable grounds to believe personal data has been compromised; assessing the scope of a compromise requires that deployed components are individually identifiable with known versions (Act 843, notification-of-security-compromise obligation, s.31)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`GDPA-S17`	Core Data Protection Principles (Sections 17-20)
`GDPA-S28`	Data Security Requirements (Section 28)
`GDPA-S31`	Data Subject Rights (Section 31)
`GDPA-S47`	Cross-Border Data Transfers (Section 47)
`GDPA-REG-1`	Data Controller Registration with DPC
`GDPA-CONSENT-1`	Consent and Lawful Processing Basis
`GDPA-BREACH-1`	Data Breach Reporting

Policy templates

Written for GH DPA:

Ghana DPA: Privacy Notice
Ghana DPA: Data Breach Reporting Procedure
Ghana DPA: Cross-Border Data Transfer Policy

And 22 from the standard set, adapted to GH DPA.