Data Protection Commission flags six companies for privacy breaches

The Data Protection Commission (DPC) has officially flagged six companies, including the major retailer Melcom and Polytex Ghana Limited, for various breaches of the country’s data protection laws. During a series of compliance checks, the regulatory body discovered that several firms were operating without the required registration or were using certificates that had long expired. This enforcement action highlights the commission's intensifying efforts to hold data controllers accountable for how they handle personal information.

As part of the sanctions, the DPC has directed the management of the affected companies to report to both the commission and the Cyber Security Unit of the Criminal Investigation Department (CID) by October 15. The commission noted that while Melcom was among the entities flagged, it deserved mention for its proactive efforts to align with national standards, suggesting its inclusion was due to specific administrative gaps rather than a total lack of engagement. Other companies, however, were found to be in more significant violation of the Data Protection Act by processing data without any legal oversight.

The DPC warned that these recent actions are only the beginning of a larger nationwide crackdown on non-compliant institutions. Enforcement exercises are scheduled to continue well into next year as the commission seeks to ensure that every organization processing personal data in Ghana is fully registered and adhering to legal safeguards. Officials have urged all business entities to review their data protection status immediately to avoid legal repercussions and potential prosecution by the CID.