Ghana Data Protection Law: Doing Business in Jurisdiction

The factor of Doing Business in Jurisdiction is used in determining the law's applicability by considering whether an organization has a commercial presence or engages in economic activities within Ghana, regardless of where the processing takes place.

Text of Relevant Provisions

DPA 2012 Art.45(1b):

"(1) Except as otherwise provided, this Act applies to a data controller in respect of data where (b) the data controller is not established in this country but uses equipment or a data processor carrying on business in this country to process the data, or"

DPA 2012 Art.45(3e):

"(3) For the purposes of this Act the following are to be treated as established in this country: (e) any person who does not fall within paragraphs (a),(b), (c) or (d) but maintains an office, branch or agency through which business activities are carried out in this country."

Analysis of Provisions

The Data Protection Act, 2012 (DPA 2012) of Ghana specifies that the law applies to data controllers that are established in Ghana and process data in Ghana, as well as to data controllers that are not established in Ghana but use equipment or a data processor carrying on business in Ghana to process data (Art.45(1b)). Additionally, the law treats as established in Ghana any person who maintains an office, branch, or agency through which business activities are carried out in Ghana (Art.45(3e)).

These provisions indicate that the law's applicability is based on the presence of a commercial entity within Ghana or the use of means situated in Ghana for data processing. This means that any organization that has a place of business in Ghana or uses means situated in Ghana for data processing would be subject to the law.

Implications

The inclusion of this factor has significant implications for businesses operating in Ghana. For example, a company that has a branch office in Ghana would be subject to the law, regardless of where the data processing takes place. Similarly, a company that uses data centers or servers located in Ghana for data processing would also be subject to the law.

Conversely, a company that does not have a place of business in Ghana and does not use means situated in Ghana for data processing would not be subject to the law.

For instance, a foreign company that processes personal data of Ghanaian residents but does not have a presence in Ghana and does not use Ghana-based data centers or servers would not be subject to the law. However, if the same company were to establish a branch office in Ghana or use Ghana-based data centers or servers for data processing, it would be subject to the law.