01
Protection principles
Lawful processing, a stated purpose, accurate data and openness with the people it concerns.
Data Protection Act, 2012 (Act 843)
Show the Data Protection Commission how you protect personal data.
CyberPlug turns the Act's principles into controls with owners and evidence, and links them to the security work you already do for ISO 27001 and the Bank of Ghana.
- Law
- Act 843, 2012
- Regulator
- Data Protection Commission
- Workflows
- Data subject rights
What it is
What the Act asks of you
Ghana's Data Protection Act, 2012 governs how personal data is collected, used, stored and shared. It sets out principles for lawful processing, gives people rights over their data, requires security safeguards and sets duties when a breach happens.
Organisations that control personal data register with the Data Protection Commission. Breaches of the Act can carry fines and, for some offences, imprisonment.
Who needs it
- Banks, insurers, fintechs and microfinance institutions.
- Health providers and any business that holds customer or employee personal data in Ghana.
What it covers
Five duties you have to be able to prove
02
Security safeguards
Technical and organisational measures to keep personal data safe, which map to the same controls as ISO 27001.
03
Breach notification
Tell the Commission and the people affected as soon as reasonably practicable.
04
Data subject rights
Access, correction and objection requests, handled and tracked to closure.
05
Registration
Your registration with the Data Protection Commission, and its renewal.
The problem
Privacy duties that nobody owns
- Policies sit in a shared drive, and nobody can say who approved the latest version.
- A data subject request arrives by email and is answered from memory, with no record of how long it took.
- Security safeguards are documented once for the Act and again for the Bank of Ghana.
How CyberPlug helps
Turn the Act into controls with owners
- 01
Principles as controls
Each duty becomes a control with a named owner, a status and linked evidence.
- 02
Policies drafted and approved in one place
Generate a policy from a framework-tailored template with its mandatory clauses filled in, or upload your own. A person approves it, and every version is recorded.
- 03
Safeguards from your systems
Read-only connectors check settings such as encryption and multi-factor authentication every 24 hours and keep the result as evidence.
- 04
Data subject rights workflows
Log requests, assign an owner and track each one to closure.
- 05
Shared evidence with ISO 27001 and the CISD
A safeguard you evidence once counts under all three.
Path to ready
From policy gaps to a record you can show
- 1
Map your personal data
Record what you collect, why, where it is stored and who sees it.
- 2
Name owners
Assign a person to each duty, including breach response.
- 3
Approve your policies
Draft or upload them and record the approval.
- 4
Evidence your safeguards
Connect systems and upload what has no API.
- 5
Register
Complete and keep current your registration with the Data Protection Commission.
- 6
Run the rights process
Track every request from receipt to response.
CyberPlug helps you organise and evidence compliance. It is not legal advice, and the Commission decides whether you comply.
One control, many frameworks
One set of safeguards for three regulators
The security measures the Act expects are the same access, encryption and logging controls that ISO 27001 and the Bank of Ghana's directive ask for. Evidence them once.
FAQ
Questions we hear most
Do we have to register with the Data Protection Commission?
Organisations that control personal data are generally expected to register. Confirm your own position with your legal adviser or the Commission.
Is CyberPlug legal advice?
No. It helps you organise controls and evidence. It does not interpret the law for your situation.
What happens if we have a breach?
The Act requires you to notify the Commission and those affected as soon as reasonably practicable. CyberPlug gives your team an owner and a record for each step.
How does CyberPlug handle our customers' personal data?
The platform reads configuration metadata, never customer records. Your data is kept separate from every other institution's, and it is encrypted whether it is stored or being sent.