The Director for Regulatory Compliance of the Data Protection Commission (DPC), Mr. Quinten Akrobetu, says the Commission has wrapped up a successful day of enforcement actions against institutions failing to comply with the Data Protection Act, 2012 (Act 843).
According to Mr. Akrobetu, the enforcement exercise which started on Monday morning, October 12, 2026, covered about five institutions across health, education and financial sectors.
“Data Protection Commission of Ghana embarked on an enforcement action starting this morning, and we are wrapping up for the day. Today, we have visited about five institutions, and I can say we’ve had a very successful day with the compliance searches that we did,” he said.
Nuffield Clinic, Nyaho Medical Centre Cited
Giving a breakdown of the day’s operations, Mr. Akrobetu said the team first visited Nuffield Clinic to check its compliance level.
“They have done some payments, but there are still some outstanding payments they are yet to do. That is the reason they couldn’t show their certificate as certified data controllers who should be processing personal data of Ghanaians,” he explained.
He said the police have requested that the management of the facility put out a statement, after which prosecution will follow.
The team then moved to Nyaho Medical Centre. According to him, the facility had registered with the Commission but its certification had expired.
“Nyaho Medical Center had actually registered with the Data Protection Commission, but their certification expired. They explained that they have actually had some correspondence to renew their certification, which is still not complete. So, we’ve also requested that they put out a statement with the police CID and then ensure that they complete the process,” Mr. Akrobetu stated.
Ghana International School Praised For Compliance
At Ghana International School (GIS), the Commission found full compliance.
“We realized that they have actually fulfilled their requirement under Section 46, which requires that they are duly registered. They have actually appointed a data protection supervisor under Section 58 and have also put in application to renew, demonstrating that they take data protection seriously and the privacy of Ghanaians very seriously. So, we are good with them,” he said.
Airport Women’s Hospital, DCI Microfinance Face Prosecution
At Airport Women’s Hospital, the team found the hospital had registered but its certification had expired. The hospital has appointed a data protection supervisor under Section 58 and had the officer trained as a certified data protection supervisor.
“What they are left with is to put their policies together, which demonstrates compliance with Section 28. That requires that they put organizational measures and technical measures to ensure that privacy of individuals are safeguarded from unauthorized access and abuse,” he noted.
The final stop was DCI Microfinance. Mr. Akrobetu said the institution had put in an initial application but failed to renew for a long time, and ignored compliance processes even after re-applying last year.
“Compliance report was sent to them to complete, to demonstrate that they have implemented the right measures to safeguard personal data of Ghanaians and to protect their privacy. But it’s turning out that they have ignored the process. Since last year, when the template was sent to them to complete, they have just ignored the process till date. So we are here. They’ll be reporting to the police CID headquarters tomorrow with their statements, and then prosecution will commence thereafter,” he said.
Other Sectors To Be Hit Before End Of Week
Mr. Akrobetu disclosed that the enforcement will continue across other sectors.
“We’ve done some health institutions today. We’ve done education. We’ve done microfinance, which is the financial sector. We’ll continue to other sectors like other educational facilities. We’ll also look at the religious sector. We’ll be looking at the media, how compliant is the media sector as well. Before end of week, we’ll be touching on every sector to ensure that institutions that collect information on individuals take the individuals seriously,” he said.
Public Must Demand Certificate Before Giving Data
The Compliance Director cautioned Ghanaians to be vigilant about where they give their personal information.
“Before we give out our information, let us be concerned about the institutions we are giving our information to. It doesn’t matter whatever service we expect from them. We should be assured that the institution is duly registered. If the institution cannot provide their data protection certificate, valid certification, that shows that they have the capacity to collect and protect your information, don’t give out your information. You do so at your own risk,” he warned.
He said failure to protect data leads to selling of information to third parties, spam and scams.
“This is how institutions sell out your information to other third parties and then at the end of the day, you are bombarded with all sorts of notices… And at the end of the day, you get scammed because you don’t know how they even get your information. So bottom line, we give our information to people who do not have the capacity to protect it,” he said.
Exercise Not To Embarrass, But To Showcase Compliance
Mr. Akrobetu stressed that the exercise is not intended to embarrass institutions but to enforce standards and showcase compliant ones.
“The exercise is not to actually go after institutions and then just embarrass them for non-compliance. We also want to showcase institutions that have taken the step to put the right measures in place. So today out of the five, we can say GIS, Ghana International School is doing so well. The others are also doing so well just that there are some gaps that they need to complete,” he said.
He added that further investigations and prosecution will be handled by the CID.
By Sampson Kumah Ifeetwube Elvis
About The Author
