GHANA’S DATA PROTECTION BILL 2025: A STRONGER SHIELD — WHAT IS IT MEANT TO ENABLE?

 INTRODUCTION

Ghana is on the verge of replacing its data protection legislation. The Data Protection Bill 2025, which proposes to repeal and replace the Data Protection Act 2012 (Act 843), is the most comprehensive overhaul of Ghana's data protection framework in over a decade. It is a serious and, in several respects, genuinely forward-looking piece of legislation. As a data protection statute, it is substantially stronger than what it replaces, with stronger rights protections, more robust institutional arrangements, clearer obligations, and greater technological awareness.

The world Ghana is legislating into, however, has changed significantly since 2012. Artificial intelligence has transformed the relationship between data and economic value. Data is no longer simply a record of individual activity requiring protection from misuse; it is increasingly a strategic resource for training, refining, and deploying AI systems. How data is governed now shapes not only whether individuals are protected, but whether economies can participate meaningfully in the AI economy.

This shift is influencing governance debates internationally. The United Kingdom's Data Use and Access Act 2025 reflects a more explicit effort to balance protection with data access, reuse, and economic enablement. The European Union, while remaining rooted in a rights-based governance philosophy, is also under pressure to reconcile protection with competitiveness and AI-era data access. The emerging direction is not the abandonment of protection, but increasing efforts to integrate protection with structured enablement.

Ghana's Bill takes a different approach. It significantly strengthens protection governance, modernises accountability, and introduces oversight for emerging technologies, including artificial intelligence. But it engages these issues primarily through a data protection lens focused on lawful processing, risk containment, and deployer-side accountability. That may be entirely coherent if it forms part of a broader, intentionally sequenced governance framework. If not, important strategic questions arise.

This distinction matters because privacy governance, data governance, and AI governance are not the same thing. Protecting individuals from misuse of personal data is one governance objective. Structuring how data can be accessed, shared, and reused for public and economic value is another. Governing artificial intelligence systems, including the balance between deployer accountability, provider responsibilities, and ecosystem enablement, is yet another. Ghana's Bill is strongest in the first category, touches parts of the third, but leaves the relationship between them strategically unresolved.

This article examines what Ghana's Data Protection Bill 2025 achieves, what it leaves open, and what that reveals about Ghana's broader digital governance challenge. It argues that while the Bill is a genuine achievement as a data protection statute, its engagement with AI raises an important question about strategic intent: whether this is one part of a broader governance design, or an emerging default response to AI governance itself. The shield is stronger. The question is what role that protection is ultimately meant to play.

 

 

WHAT GHANA HAS BUILT

The Data Protection Bill 2025 is not a marginal update. It is a significant reconstruction of Ghana's data protection governance architecture, and the improvements it introduces are real, substantial, and deserve recognition before the harder strategic questions are asked.

The institutional transformation alone is substantial. The 2012 Act created a relatively lean Data Protection Commission with limited enforcement capacity. The Bill replaces this with a more empowered Data Protection Authority, equipped with stronger enforcement powers, broader regulatory capacity, and oversight mechanisms consistent with a more robust compliance framework. This is not a cosmetic rename. It is the creation of a more credible regulatory institution capable of serious oversight—an essential foundation for any modern data protection regime.

The compliance architecture is also materially stronger. Data Protection Officers become mandatory, replacing the optional supervisory arrangements under Act 843 with a more formal compliance function embedded across the economy.

Two provisions deserve particular attention. The first is Clause 47's mandatory Data Protection Impact Assessment requirement, absent from Act 843, requiring formal risk assessment before processing likely to affect the rights and freedoms of data subjects. The second, more conceptually significant, is Clause 46's data ownership provision. It states that personal data remains the property of the data subject and shall not be deemed owned by another person solely by virtue of its processing. This effectively positions the data controller as a custodian rather than an owner. This departs from the GDPR, which does not frame personal data in explicit property terms, and introduces a distinctive governance concept that may shape future debates about control, stewardship, and data rights in Ghana.

The Bill also introduces capabilities Act 843 entirely lacked: mandatory Legitimate Interest Assessments, data protection by design and by default, AI-related accountability obligations framed through the logic of data protection governance, and a more developed cross-border transfer framework, including transfer risk assessments and localisation protections for particularly sensitive categories of data. These are meaningful advances in modernising Ghana's protection framework.

Taken together, these provisions represent a framework that is not merely updated but genuinely upgraded—one that takes the rights of Ghanaian data subjects seriously and creates stronger institutional architecture to enforce them. That achievement is real and should be recognised as an important foundation. The harder question is not whether this is stronger protection, but how this foundation fits within Ghana's broader digital governance strategy, particularly as artificial intelligence becomes a more central policy and economic concern.

THE GLOBAL GOVERNANCE SHIFT

To understand what Ghana's Bill leaves unresolved, it is necessary to understand the broader shifts in global data governance. The issue is not simply whether the Bill contains gaps, but what governance philosophy it reflects at a time when established approaches are being reassessed under the pressures of artificial intelligence, digital competitiveness, and economic strategy.

The broader rights-based privacy governance tradition that shaped earlier European and Commonwealth data protection regimes provided much of the philosophical orientation from which Act 843 was drawn. This included influences from frameworks such as the EU Data Protection Directive 95/46/EC and the United Kingdom's Data Protection Act 1998, both of which informed privacy governance across many Commonwealth jurisdictions.

That tradition was built on a clear premise: protection is the primary organising value. Personal data should be governed through legal frameworks that give individuals meaningful control over how information concerning them is collected, processed, and used. For decades, this philosophy shaped data protection governance globally, including in Ghana.

The United Kingdom's Data (Use and Access) Act 2025 is among the clearest recent expressions of this shift. Even its title signals a change in governance emphasis. Legislative titles do not determine legal mandate on their own, but they often reflect governing philosophy. The move from protection-centric framing toward the language of use and access suggests a more explicit recognition of data not only as a rights-sensitive asset requiring protection, but also as an economic resource requiring structured enablement. The legislative direction suggests that while protection remains essential, it no longer stands alone as the singular organising philosophy.

The European Union presents a more nuanced picture. It remains anchored in a rights-based governance tradition, but it too is confronting tensions that artificial intelligence creates for traditional data governance models. Many AI systems rely on large-scale data access, iterative reuse, and adaptive learning in ways that create friction with governance frameworks built primarily around purpose limitation, data minimisation, and tightly bounded lawful use. The European response is therefore less a rejection of protection than an attempt to reconcile rights protection with strategic enablement in an AI-driven economy.

Taken together, these developments suggest an important governance shift: protection remains indispensable, but protection alone is increasingly not treated as the only organising principle for data governance in the age of artificial intelligence. The strategic question has expanded from how data should be protected to how it should also be responsibly accessed, governed, reused, and mobilised for innovation, competitiveness, and public value.

Ghana's Bill remains more firmly anchored in the earlier paradigm. It strengthens purpose limitation, deepens consent architecture, and expands protection obligations. Even where it engages artificial intelligence and emerging technologies, it does so primarily through a data protection governance lens focused on accountability, lawful processing, and risk containment. That may be entirely coherent if these measures are intended as one component of a broader governance framework. If not, the Bill risks becoming an emerging default response to AI governance through privacy law alone.

In 2012, that orientation was entirely consistent with both the prevailing global model and Ghana's stage of digital development. In 2025, as major jurisdictions grapple with how privacy governance interacts with broader strategic digital objectives, the harder question is not whether Ghana should strengthen protection, but how that protection is intended to fit within the country's wider digital governance strategy.

WHAT THE BILL DOES NOT ANSWER

If the preceding question is what governance philosophy Ghana's new data protection framework reflects, the deeper question is what it leaves unresolved. The issue is not that Ghana's Data Protection Bill 2025 contains technical omissions, nor that a privacy statute should itself function as a complete digital governance framework. If a broader national digital governance architecture already exists—or is intentionally being developed—in which this Bill addresses the privacy dimension of data and AI governance, that would be entirely coherent. The real issue is whether this relationship is intentional and, if so, how that broader governance architecture is being articulated. Understanding this requires distinguishing between what a data protection statute does and what a broader data governance framework must do.

A data protection statute asks: how do we prevent data from being misused? Ghana's Bill answers that question comprehensively. A broader data governance framework asks a different question: what is data for, and how should it be governed in ways that protect people while also enabling legitimate uses that serve public and economic value? Ghana's Bill touches aspects of that broader terrain, but it does not meaningfully articulate that strategic question as a governing philosophy.

The most immediate unresolved issue is economic. The Bill's stated objectives—protecting privacy, preventing exploitation, and regulating the digital economy in ways that build trust—do not explicitly frame economic growth, innovation enablement, or the strategic use of data as development objectives to be actively balanced alongside protection. This is not merely a drafting detail. It reflects a governance posture. A regulator whose primary mandate is framed around protection and trust-building will naturally prioritise those objectives unless a broader balancing function is clearly embedded within its institutional philosophy. Other jurisdictions have begun to confront this balancing question more explicitly. Ghana's proposed Data Protection Authority has no equivalent strategic counterweight. Regulators act within the mandates they are given.

The second unresolved issue is structural. The Bill contains no strategic data mobility architecture—no framework designed to enable trusted movement of customer-authorised data across systems in standardised, interoperable ways where public and economic value may depend on it. This is distinct from individual data portability rights. The point is not that Ghana should replicate any specific foreign Smart Data or Open Banking model. It is that strategic data governance requires conscious mechanisms for trusted data mobility where competition, innovation, and broader ecosystem participation depend on access rather than mere possession. In Ghana, where mobile money, telecommunications, and financial services data are concentrated within a relatively small number of dominant providers, the absence of such an architecture means data generated by Ghanaian citizens and businesses remains structurally locked within incumbent systems. It cannot easily flow to smaller innovators, agricultural platforms, health technology startups, financial inclusion services, or other emerging actors capable of creating new forms of value.

The third unresolved issue is likely to become the most consequential in the medium term. The Bill engages artificial intelligence, but it does so primarily through a data protection governance lens focused on downstream accountability, lawful processing, and risk containment. Clause 53 requires AI-driven decisions to be explainable and contestable, mandates human oversight, and introduces bi-annual audits for AI systems in critical sectors. These are appropriate protections. But this is governance of AI deployment risk, not a broader digital governance framewrok for AI-era capability building. The Bill does not address provider-side governance questions, nor does it indicate how privacy governance is intended to interface with Ghana's broader AI ambitions. There are no visible mechanisms for trusted data reuse or clearer strategic pathways showing how traditional data protection constraints will align with national AI development objectives.

That disconnect matters because Ghana's National AI Strategy (2025–2035) speaks in fundamentally different terms. Its ambition is to build, own, and govern artificial intelligence as a driver of economic transformation across sectors including agriculture, healthcare, education, and financial services. The Data Protection Bill, by contrast, primarily seeks to protect, regulate, and contain risk within data processing environments. Both objectives are legitimate. But they reflect different governance logics. A country that aspires to AI leadership while maintaining no clearly articulated bridge between those strategic ambitions and its data governance architecture has not yet resolved a central tension in its digital policy.

The fourth and deepest unresolved issue is philosophical. The Bill contains no clear articulation of Ghana's own balance between data protection and strategic data use. It does not ask whether the broader rights-first privacy governance model it substantially deepens remains the most appropriate fit for Ghana's developmental stage, institutional capacity, digital market maturity, and long-term strategic ambitions. Nor does it meaningfully engage whether Ghana's own governance context may justify a different balance between individual rights protection and collective public-value data use, provided that balance is consciously defined and institutionally safeguarded. Instead, the Bill largely inherits an established governance philosophy rather than deliberately constructing one of its own. In doing so, it leaves Ghana without a clearly defined strategic position from which to assess how global data governance itself is evolving.

 

THE AI STRATEGY DISCONNECT

If the broader concern is that Ghana has not yet clearly articulated what its data governance framework is ultimately meant to enable, the clearest expression of that unresolved question lies in its relationship with the country's artificial intelligence ambition.

Ghana's National Artificial Intelligence Strategy 2025–2035 is ambitious. It positions Ghana as a trailblazer for AI leadership in Africa and beyond, identifies priority sectors for deployment, and commits to building the capabilities, infrastructure, and ecosystems required to realise that ambition. Its strategic posture is not merely to adopt AI, but to build, own, and govern systems that reflect Ghana's values and developmental priorities.

The Data Protection Bill 2025 and the National AI Strategy are emerging within the same broader national digital agenda. It is fair to acknowledge that the Bill's development preceded the formal launch of the AI Strategy, making the absence of explicit alignment understandable as a matter of policy sequencing. But if foundational instruments of Ghana's digital future can emerge on parallel tracks without visible strategic calibration, the issue is no longer simply timing. It raises a broader institutional question about whether fragmented governance arrangements—including the Cyber Security Authority (CSA), Data Protection Commission (DPC), and National Information Technology Agency (NITA)—are structurally equipped to provide the level of strategic coordination Ghana's digital transformation increasingly requires. Aligning privacy governance, cybersecurity, digital infrastructure, innovation policy, AI ambition, and digital economic development may require clearer institutional coherence than is currently visible.

The substantive disconnect is equally important. Artificial intelligence depends on access to data that is not only protected, but lawfully usable, reusable, and strategically mobilisable. A governance framework that significantly strengthens protection obligations while offering no clearly articulated pathways within the current governance architecture for trusted AI-era data enablement creates friction with an AI strategy that aspires to leadership and capability-building.

This becomes clearer when examining how the Bill engages AI. Its approach is primarily through a data protection governance lens focused on deployer-side accountability and risk containment. Clause 53 requires explainability, contestability, human oversight, and audits for AI systems in critical sectors. These are appropriate safeguards. But they reflect governance of downstream AI deployment risk, not a broader framework for AI capability-building, provider-side governance, or ecosystem enablement.

The contrast is therefore philosophical as much as operational. The AI Strategy speaks in the language of capability creation: build, own, govern. The Bill speaks in the language of protection governance: protect, restrict, contain. Both are legitimate governance instincts. The issue is not that one should displace the other, but that no clearly articulated bridge is yet visible between them.

There is, however, an important counterargument. If Ghana's AI ambition is primarily deployment rather than development—if the strategy envisions Ghana principally as a sophisticated adopter, integrator, and regulator of AI systems built elsewhere—then the disconnect is less severe, provided Ghana is intentional about that positioning. A deployment-oriented AI economy requires strong citizen protections, transparency, accountability, and safeguards around AI use. On that reading, the Bill and the strategy may be serving distinct but complementary purposes.

But this counterargument exposes the central strategic question: is Ghana intentionally adopting a privacy-led, deployment-oriented approach to AI governance, or is the Bill only one component of a broader AI governance architecture that has not yet been clearly articulated? Whether Ghana intends to be primarily a deployer, an ecosystem builder, or a more substantive AI developer remains unresolved. The strategy's language suggests something beyond pure downstream adoption. Yet the data governance architecture emerging alongside it reflects a more deployment-oriented protection posture.

Examined against the strategy's three-part ambition, the picture becomes clearer. On own, the Bill is conceptually strong. Clause 46 expressly positions personal data as the property of the data subject and recognises controllers and processors as custodians or stewards, introducing an important governance concept around stewardship and control. On govern, the Bill is equally substantial, with stronger institutions, enforcement powers, and accountability architecture. But on build, the framework remains materially thinner. Building AI capability requires more than protection governance. It requires lawful pathways for strategic data access, reuse, and enablement. That broader governance philosophy has not yet been clearly articulated.

CONCLUSION

Ghana's Data Protection Bill 2025, when enacted, will give Ghanaian citizens the strongest data protection rights and safeguards they have yet had. The shield is genuinely stronger, and that achievement deserves recognition.

The harder question is not whether stronger protection matters, but how that protection fits within the strategic digital economy Ghana seeks to build. Data governance requires both protection and enablement. A vehicle may have powerful brakes, but brakes alone do not create movement.

Ghana has already signalled its destination. The National AI Strategy 2025–2035 points beyond adoption toward a broader ambition: to build, own, and govern artificial intelligence. The difficulty is that the Data Protection Bill reflects a different governance logic—one focused primarily on protecting individuals, structuring accountability, and mitigating AI-related risks to data subjects. Both are legitimate governance instincts. But they are not the same, and no clearly articulated bridge between them is yet visible within Ghana's broader digital governance architecture.

This raises the central strategic question: is Ghana intentionally adopting a privacy-led, deployment-oriented approach to AI governance, or is the Bill only one component of a broader AI governance architecture that has not yet been clearly articulated? If the former, the Bill may be well suited to that purpose. If the latter, the missing strategic bridge becomes consequential, because building AI capability requires lawful pathways for trusted data access, strategic reuse, innovation enablement, and institutional coordination across the digital governance ecosystem.

It is fair to acknowledge that the Bill preceded the formal launch of the AI Strategy. But if foundational instruments of Ghana's digital future can emerge without visible strategic calibration, the issue is not merely timing. It is institutional coherence. Fragmented governance arrangements across data protection, cybersecurity, infrastructure, innovation, and digital transformation may no longer be sufficient to provide the integrated strategic coordination the AI era increasingly demands.

The unresolved issue, then, is not whether Ghana should protect data. It should. The deeper question is what that protection is ultimately meant to enable. Until that question is answered clearly, Ghana's digital governance architecture will remain stronger on protection than on strategic direction.