Parliament passes Data Protection Amendment Bill
Lawmakers have approved sweeping changes to Ghana’s data privacy framework, mandating stronger safeguards for citizen information held by public and private institutions.
Ghana’s Parliament on Tuesday passed the Data Protection Amendment Bill 2026 after months of debate, mandating that all organisations handling personal data of more than five thousand citizens register with the Data Protection Commission and implement end-to-end encryption by 2027.nnThe bill, introduced by Communications Minister Ursula Owusu-Ekuful, expands the scope of the 2012 Data Protection Act to cover cloud storage providers, fintech platforms and social media companies operating in Ghana regardless of where they are headquartered.nnMajority Leader Osei Kyei-Mensah-Bonsu described the passage as “a landmark moment for digital rights in Ghana,” while civil society groups broadly welcomed the legislation but called for stronger whistleblower protections for employees who report data breaches.nnA penalty of up to GH¢2 million and a five-year custodial sentence now awaits organisations found guilty of deliberate data misuse. Companies have eighteen months to achieve compliance before enforcement begins.nnCritics on the minority side argued that the timelines were too ambitious for smaller businesses and that the Data Protection Commission lacked the technical capacity to audit the thousands of organisations that would fall under the new rules. The Commission’s executive director promised to hire 150 additional inspectors before the compliance deadline.nnThe bill now goes to the President for assent. It is expected to be gazetted within three weeks.
