The Data Protection Commission has received two new pickup vehicles to strengthen enforcement of the Data Protection Act and expand its field operations.
The vehicles, procured with the Commission's Internally Generated Funds (IGF), are expected to support enforcement activities and the establishment of regional offices as the Commission intensifies efforts to improve compliance with data protection laws.
The Deputy Minister of Communications, Digital Technology and Innovations, Mohammed Adams Sukparu, officially handed over the vehicles to the Commission at a brief ceremony in Accra last Thursday.
The Executive Director of the Data Protection Commission, Dr Arnold Kavaarpuo, later told the Ghana News Agency that the Commission had declared 2026 the "Year of Enforcement" to compel institutions to comply with the Data Protection Act, 2012 (Act 843).
He said the Commission, which currently operates only from its head office, is taking steps to establish offices in the Eastern, Ashanti, Northern, Western and Bono regions by the end of the year, and that the new vehicles would support the opening and running of these regional offices as well as strengthen enforcement. "We have had significant logistical challenges, not least of it being the ability to operate and to have vehicles that we can use to perform our mandate," he said.
Dr Kavaarpuo said the enforcement drive is aimed at ensuring institutions that collect and process personal information comply with the requirements of Act 843. He explained that all public and private institutions that process or intend to process personal information are required by law to register with the Commission, and that compliance extends beyond registration to include having appropriate data protection policies, conducting vulnerability and penetration assessments where necessary, undertaking data protection impact assessments for significant processing activities, and ensuring adequate safeguards for personal information.
He said the Commission is particularly concerned about the protection of sensitive information, including children's data, health data and information with national security implications. He cautioned schools against using children's photographs for promotional purposes without the required consent, stressing that "those students are there to school. They are not marketing objects." On health information, he said the Commission would pay closer attention to how such data is collected, stored, accessed and shared, given its sensitive nature.
Dr Kavaarpuo said the Commission's enforcement efforts had initially faced challenges because inadequate public awareness meant some institutions only became aware of the Commission once enforcement action began, and that the Commission had therefore combined enforcement with public education to improve understanding and compliance.
He said the Commission's expanded regional presence should make it more accessible and visible to the public, particularly people seeking redress over data breaches or misuse of personal information. "Data is as much a national security imperative as it is a commercial or personal nature," he said, stressing the need for Ghana to safeguard its data infrastructure and protect citizens from identity theft, unauthorised access and other risks.
The Data Protection Commission was established under the Data Protection Act, 2012 (Act 843), pursuant to the constitutional right to privacy, and is mandated to regulate the processing of personal information, promote compliance with data protection requirements and protect individuals from the misuse of their personal data.
