Ghana Data Protection Act 2012 (Act 843) and automated decision-taking

What it is

The Data Protection Act 2012 (Act 843) is Ghana’s data protection law. It was assented to on 10 May 2012 and established the Data Protection Commission as the regulator. Section 41 sets out an individual’s rights in relation to automated decision-taking, and it is the main binding rule in Ghanaian law aimed at decisions made by algorithms, including AI systems, about people.

A draft Data Protection Bill 2025, published by the Data Protection Commission, would repeal Act 843 and replace the Commission with a Data Protection Authority. Until it passes, Act 843 applies.

Who it applies to

Section 45 applies the Act to a data controller established in Ghana that processes data in Ghana, to a controller not established in Ghana that uses equipment or a data processor carrying on business in Ghana, and to processing of information that originates partly or wholly from Ghana. A controller not incorporated in Ghana must register as an external company. Data that originates outside Ghana and only transits through the country is excluded.

What it requires

Section 41 works through notices.

• Right to require. Under section 41(1), an individual may at any time, by written notice, require a data controller to ensure that any decision taken by or for it which significantly affects the individual is not based solely on automated processing of their personal data.
• Duty to notify. Under section 41(2), even without a notice, where a decision that significantly affects an individual is based solely on automated processing, the controller must notify the individual as soon as reasonably practicable that it was taken on that basis.
• Reconsideration. The individual may then, by written notice, require the controller to reconsider the decision within twenty-one days of receiving the notification. Under section 41(3), the controller has twenty-one days from receipt of the notice to tell the individual in writing what steps it intends to take.
• Enforcement. Under section 41(5), where the Commission is satisfied on a complaint that a controller has failed to comply, it may order compliance.

Section 41(4) disapplies the section for decisions made in the course of considering whether to enter into a contract with the data subject, with a view to entering into it, or in performing it, for a purpose authorised or required by an enactment, or in other circumstances the Minister prescribes.

Other parts of the Act apply alongside section 41. Section 31 requires a controller to notify the Commission and the data subject as soon as reasonably practicable where personal data has been accessed or acquired by an unauthorised person. Sections 46 and 53 require registration with the Commission before personal data is processed. Section 43 gives an individual who suffers damage or distress through a contravention a right to compensation.

For an AI system, that turns into three practical questions. Which systems make decisions that significantly affect individuals without a person involved? Is there a process to notify those individuals and to reconsider a decision within the twenty-one-day windows? And does the contract or enactment exception actually cover the decision, or only part of it?

The draft Data Protection Bill 2025

The draft Bill keeps the section 41 rule as clause 65 and expands it. It states that a data subject has the right not to be subject to a decision based solely on automated processing, including profiling, and lists examples of automated processing that include emerging technology systems, automated chatbots, and facial and emotional recognition. Clause 53, on the application of emerging technologies, would require technology-driven decisions impacting data subjects to be explainable, contestable and subject to human oversight to prevent bias and harm, and would require systems used in critical sectors such as health, finance, banking, government services and transport to undergo audits bi-annually. Clause 47 would require a data protection impact assessment before processing likely to pose real risk, with a report to the Authority for review and approval where high risk remains.

The draft is not law. Its wording may change before it is laid before Parliament.

Key dates

• 10 May 2012. Act 843 is assented to.
• 18 May 2012. Act 843 is notified in the Gazette.
• 2025. The Data Protection Commission publishes the draft Data Protection Bill 2025.
• 24 April 2026. Ghana launches its National Artificial Intelligence Strategy 2025 to 2035.

How it relates to other frameworks

Section 41 works through notices from the individual and the controller, rather than the general right with exceptions in GDPR Article 22 or South Africa’s POPIA section 71. The draft Bill moves closer to those models by stating a right not to be subject to solely automated decisions. Organisations using AI in Ghana often pair Act 843 with an international framework such as ISO/IEC 42001 or the NIST AI RMF to structure their risk and impact assessments, which the draft Bill and the national AI strategy both point towards.

A note on this page

This is Aicura’s reading of section 41 of Ghana’s Data Protection Act 2012 and the draft Data Protection Bill 2025. It is not legal advice and it is not the Act itself. Read the Act and the draft Bill as published by the Data Protection Commission, and take advice on how they apply to your organisation.