The Data Protection Commission (DPC) on Monday embarked on an exercise in Accra to enforce data protection requirements and found two hospitals operating with expired data protection certificates, while another health facility had outstanding fees and other compliance issues.
Briefing the press, the Executive Director of the Commission, Dr Arnold Kavaarpuo, said the Commission is no longer relying solely on education and persuasion to secure compliance, 14 years after the passage of the Data Protection Act, 2012 (Act 843).
“We cannot rely indefinitely on education and persuasion alone,” he said, adding that it would be unfair to organisations that had met their legal obligations if others were allowed to disregard the same requirements without consequences.
Dr Kavaarpuo said registration alone did not amount to full compliance with the law.
“An organisation may have a registration certificate and still fail to meet its obligations concerning the collection, use, storage and protection of personal information,” he said.
He said the Commission had recorded 2,575 data controller registrations in 2026, exceeding the annual figures for previous years, but stressed that registration and training must translate into compliance.
Dr Kavaarpuo said officers would verify registration status and examine how organisations collected, processed, stored and protected personal information, as well as the measures in place to safeguard individuals’ rights.
He said the exercise would cover both public and private institutions, adding that government agencies were also accountable under the law.
Dr Kavaarpuo said Section 56 of Act 843 made the processing of personal data without the required registration punishable, upon summary conviction, by a fine, imprisonment for up to two years, or both.
The law also provides for enforcement notices and other regulatory measures.
He said the Commission would pursue prosecution where warranted, while ensuring that its actions remained fair, professional and consistent with due process.
“Our primary objective is compliance, not punishment for its own sake, but organisations must understand that the law has consequences,” he said.
He urged organisations to review their compliance status, register where required and renew expired registrations.
In relation to the organisations visited on Monday (October 12, 2026), the Director of Regulatory and Compliance at the Commission, Mr Quintin Akrobotu, said the microfinance company had failed to renew its registration and complete a compliance report sent to it the previous year.
He said representatives of the company were scheduled to report to the Criminal Investigations Department (CID) headquarters on Tuesday, October 13, 2026, for possible prosecution.
Mr Akrobotu said the two health facilities visited were registered with the Commission, but their certificates had expired.
A third facility, a clinic was also found to have outstanding payments to the Commission and was directed to give a statement to the police.
At the said clinic, Mr Akrobotu said the facility had not appointed a Data Protection Supervisor and had unpaid fees dating back to at least January 2025.
He said the clinic had not conducted a privacy impact assessment of the electronic health system used to store patient records and lacked adequate organisational and technical measures to protect personal information.
The Commission expressed concern that the clinic was collecting sensitive information without the required arrangements and oversight to protect it.
Mr Akrobotu said the inspections would continue into 2027 and cover other sectors, including religious institutions and the media.
He advised the public to check whether institutions collecting their personal information held valid data protection certificates.
He warned that failure to comply with data protection requirements could expose personal information to misuse, including sale to third parties and use in scams.
