If your business keeps a list of customer phone numbers, you are handling personal data — and Ghana's Data Protection Act, 2012 (Act 843) has something to say about how you do it. This is not legal advice, but it is the plain-English version every business owner should understand.

Yes, It Applies to You

A common misconception is that data protection is a concern only for banks and big tech. In fact, Act 843 applies to almost any organisation that collects or processes personal data about people in Ghana — a boutique with a customer WhatsApp list, a school with student records, a clinic, a delivery service, a landlord. If you hold information that identifies a living person, you are what the law calls a "data controller."

The Core Principles, in Plain Terms

• Collect only what you need — do not ask for a Ghana Card number if a phone number will do.
• Say why — people should know what you are collecting and what you will use it for.
• Use it only for that — data collected to deliver an order should not quietly become a marketing list without consent.
• Keep it accurate and secure — protect it from loss, theft and unauthorised access.
• Do not keep it forever — hold it only as long as you have a genuine reason to.

Registration and the Commission

Act 843 established the Data Protection Commission, and it requires data controllers to register. Many Ghanaian businesses have never done this — which does not make the obligation disappear. If customer data is central to how you operate, registration and a basic privacy policy are part of running a legitimate business, not optional extras.

What a Breach Response Looks Like

If data is lost or stolen, Ghana's framework expects a reasonable, timely response — this is not the European 72-hour clock, but you are expected to act promptly and to show you took the matter seriously. Practically, that means knowing in advance what you would do: who you would tell, how you would contain it, and how you would inform affected people. A breach plan written calmly today is worth far more than a panicked scramble on the day.

Practical Steps for an SME

• Write a short, honest privacy policy and put it where customers can see it.
• Limit who on your team can access customer data — not everyone needs everything.
• Use systems with access controls, encryption and audit logs, not a shared spreadsheet on one laptop.
• Have a plan for deletion requests — and know that some records (financial ones in particular) must legally be retained for years even after a customer asks to be forgotten.

That last point trips up many businesses: the right to erasure is real, but it is balanced against record-retention laws. Getting that balance right is exactly the kind of thing we build into the products we ship.

"Treat your customers' data the way you would want a business to treat yours. The law, in the end, is just that idea written down." — Tip Consult GH

Want your systems built to respect this from the ground up? Talk to us — compliance designed in is far cheaper than compliance bolted on.