The Data Protection Act, 2012 of Ghana uses the factor of processing within the jurisdiction as a key element in determining the law's applicability.

Text of Relevant Provisions

DPA 2012 Art.45(1a):

"(1) Except as otherwise provided, this Act applies to a data controller in respect of data where (a) the data controller is established in this country and the data is processed in this country,"

Analysis of Provisions

The Data Protection Act, 2012 of Ghana applies to data controllers who are established in Ghana and process data within the country. This provision sets a clear territorial scope for the law's applicability based on two cumulative conditions:

1. The data controller's establishment in Ghana
2. The processing of data within Ghana

The phrase "the data controller is established in this country" indicates that the law applies to entities that have a physical or legal presence in Ghana. This could include companies incorporated in Ghana, branches of foreign companies, or individuals conducting business activities in the country.

The second part of the provision, "and the data is processed in this country," further narrows the scope to data processing activities that occur within Ghana's borders. This means that even if a data controller is established in Ghana, the law would not apply to their data processing activities conducted outside the country.

Implications

This provision has several implications for businesses and organizations:

1. Local companies: Ghanaian companies processing data within the country are clearly subject to the Data Protection Act, 2012.
2. Foreign companies with local presence: Multinational corporations with establishments in Ghana must comply with the Act for their data processing activities within the country.
3. Data processing location: Companies established in Ghana but processing data outside the country may not be subject to this specific provision of the Act. However, they should be aware of other provisions that might still apply to their activities.
4. Cloud services: The use of cloud services or remote data processing facilities located outside Ghana by Ghana-based companies might fall outside the scope of this provision, depending on how "processed in this country" is interpreted.
5. Compliance strategies: Organizations operating in Ghana need to carefully consider the location of their data processing activities when designing their compliance strategies.