Data Protection Commission refers two hospitals to police for prosecution

The Data Protection Commission (DPC) has referred two hospitals and a microfinance firm to the police for criminal prosecution following a compliance enforcement exercise in Accra. The move comes after the commission identified that these organisations were processing personal data while operating with expired data protection certificates. This enforcement action is part of the commission's intensified efforts to ensure that all entities handling sensitive information adhere strictly to the provisions of the Data Protection Act, 2012 (Act 843).

During the inspection, the DPC enforcement team discovered that the health facilities and the microfinance company had failed to renew their annual certifications and were also in arrears regarding required regulatory fees. Beyond administrative lapses, the commission expressed concern that such non-compliance could compromise the privacy and security of individual data held by these institutions. The exercise highlighted that merely registering with the commission is insufficient; organisations must maintain active compliance and fulfill their ongoing data protection obligations to legally operate.

The DPC has signaled that this enforcement initiative will be sustained and extended across various sectors to purge the system of non-compliant data controllers. Officials emphasized that under Act 843, the commission possesses the legal mandate to pursue prosecution against any entity found to be in breach of the law. Organisations nationwide are now being urged to audit their compliance status immediately to avoid legal repercussions, as the commission plans to continue its unannounced inspections to safeguard the personal data of Ghanaian citizens.