Guide / Guide · Data protection
Ghana’s Data Protection Act, 2012 (Act 843): a guide for law firms
Few businesses hold more sensitive personal data than a law firm: identity documents, health records in injury claims, criminal histories, family disputes. Act 843 sets the rules for handling it. Here is what they mean for a practice, and how to build them into everyday work.
Does the Data Protection Act, 2012 apply to law firms in Ghana?
Yes. A law firm that collects and uses personal data about clients, staff or other people is a data controller under the Data Protection Act, 2012 (Act 843). It must follow the Act’s eight principles, register with the Data Protection Commission and renew every two years, and report data breaches promptly.
Who does Act 843 apply to?
Act 843 regulates the processing of personal data: information about an individual who can be identified from it, alone or with other information the firm holds. It established the Data Protection Commission, which keeps the Data Protection Register, investigates complaints and enforces the Act.
For client matters, your firm is the data controller: it decides why and how personal data is processed. Software vendors and other service providers that process data on your behalf act as processors, and you remain responsible for choosing them carefully.
What are the eight data protection principles?
| Principle | What it means for a firm |
|---|---|
| Accountability | The firm must be able to show it complies: policies, training, records of decisions. |
| Lawfulness of processing | Collect only what is necessary, relevant and not excessive for the matter. |
| Specification of purpose | Collect data for explicit, lawful purposes connected with the firm’s work. |
| Compatibility of further processing | Re-use data only for compatible purposes, or with consent, or where an exception such as court proceedings applies. |
| Quality of information | Keep client data complete, accurate and up to date. |
| Openness | Tell people why their data is collected; let them access and correct it. |
| Data security safeguards | Take appropriate technical and organisational measures against loss, damage, unauthorised access or processing. |
| Data subject participation | Let individuals exercise their rights under the Act. |
Do law firms need to register with the Data Protection Commission?
Data controllers must register with the Data Protection Commission and renew their registration every two years; new controllers are expected to register soon after they begin business. Failing to register is an offence. Controllers should also designate a data protection supervisor to oversee compliance, under criteria the Commission sets.
What is special personal data?
Act 843 gives extra protection to special personal data: data about children under parental control, and about a person’s religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life or criminal behaviour. Law firms routinely hold this kind of data (in family, criminal, employment and personal-injury work), so restrict who can see it and record the basis on which you hold it. Where a field is optional, collect it only with recorded consent.
What must a firm do after a data breach?
If personal data is believed to have been accessed or acquired by an unauthorised person, the controller must notify the Commission and the affected person as soon as reasonably possible after discovering it. Prepare a breach plan before you need one: who decides, who notifies, and how you’ll know what was exposed, which is where audit logs earn their keep.
Can client data be stored outside Ghana?
Act 843 has no dedicated cross-border transfer regime of the kind found in the GDPR, but the principles still apply wherever data is stored: security safeguards, purpose limitation and openness. If client data is held abroad (as with most cloud software), say so in your privacy notice and engagement letters, choose providers with strong security, and make sure your contracts bind them to protect the data.
A checklist for your practice
- Register (and renew) with the Data Protection Commission and name a data protection supervisor
- Publish a privacy notice and reflect data handling in your engagement letters
- Give staff access by role, and wall off sensitive matters
- Keep an audit trail of who accessed and changed client records
- Encrypt data in transit and at rest, including on laptops and phones
- Vet your vendors: where is the data, who can access it, how is it secured?
- Have a breach-response plan and test it
See how Asem Legal approaches this on our security page.
Frequently asked questions
Do law firms need to register with the Data Protection Commission?
Yes. Law firms process personal data as data controllers, and data controllers must register with the Commission and renew their registration every two years.
What is special personal data under Act 843?
Data relating to children under parental control, and to a person’s religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life or criminal behaviour.
Must a data breach be reported in Ghana?
Yes. Where personal data is believed to have been accessed or acquired by an unauthorised person, the controller must notify the Data Protection Commission and the data subject as soon as reasonably possible.
Can a Ghanaian law firm use cloud software hosted abroad?
Act 843 does not have a dedicated cross-border transfer regime, but its principles, especially security safeguards and openness, still apply. Be transparent with clients and choose providers with strong safeguards.
Sources
- Data Protection Act, 2012 (Act 843), GhaLII
- Ghana factsheet, Data Protection Africa
- Data Protection Commission, Ghana
This guide is general information for law firms, not legal advice. Laws and regulator guidance change: check the current text of each instrument and the regulator's latest notices before relying on it.
Keep reading
- Security at Asem Legal: EU storage, encryption, isolation and audit trails.
- AML & KYC for law firms: Collecting identity data for due diligence.
