Nyaho Medical Centre has been instructed to report to the Criminal Investigations Department of the Ghana Police Service to give a statement regarding the expiry of its data protection certificate. The directive follows an operation by the Data Protection Commission on Monday, October 12, 2026, as part of efforts to enforce compliance with Ghana’s data protection requirements.
The Commission flagged the Accra‑based healthcare facility over its expired certificate, with investigations expected to establish the circumstances surrounding the lapse and whether the facility has complied with the relevant regulatory requirements. Healthcare facilities routinely collect and process sensitive personal information, including patients’ medical histories, diagnoses, contact details and treatment records, making compliance with data protection requirements essential to safeguarding patient privacy.
The DPC is responsible for overseeing compliance with Ghana’s data protection framework, which sets out obligations for organisations that collect and process personal data. Under the Data Protection Act, 2012 (Act 843), organisations processing personal data are required to comply with applicable registration and data protection obligations. However, the circumstances surrounding the expiry of Nyaho Medical Centre’s certificate, including how long its registration has lapsed, remain unclear.
The Commission has not yet provided further details on its findings against the facility or indicated whether the investigation could result in additional regulatory or legal action. Nyaho Medical Centre’s response to the development was not immediately available.
