Are you compliant with Ghana's Data Protection Act?

If you keep tenant phone numbers in a spreadsheet, the Data Protection Act 2012 (Act 843) is talking to you. That includes you whether you own one unit or 100. The Act doesn't have a small-portfolio exemption — only a registration threshold, which we'll come to.

What the Act actually says

Passed in 2012 and enforced by the Data Protection Commission (DPC) since 2014, the Act sets rules for anyone — individual or business — who collects, stores, or uses personal data about other people.

In a typical rental setup, you collect:

• Tenant name
• Phone number(s)
• Email address
• Ghana Card or passport copy
• Employer name and contact
• Reference contact details
• Bank account or mobile-money number (for receiving rent)
• Family or emergency contact

Every one of these is personal data. The Act says you must:

1. Tell the tenant why you're collecting it.
2. Only use it for the reason you stated.
3. Keep it accurate and up to date.
4. Store it securely.
5. Delete it when it's no longer needed.
6. Not share it with third parties without consent.

Do you need to register with the Commission?

This is the part most landlords skip. The DPC requires registration as a "data controller" if you process personal data above certain thresholds.

For a small landlord (under 10 tenants), formal registration may not be strictly required — but the obligations of the Act apply regardless. If you grow past that, registration is on the table. The fees are tiered by data volume.

If you manage 10+ units, talk to a Ghanaian lawyer familiar with data protection — not all of them are — about whether you need to register.

6-item compliance checklist

1. Have a sentence in your lease that says what tenant data you'll collect, why, and how long you'll keep it. One paragraph: "We will keep your name, phone number, ID copy, references, and payment history for the duration of the lease and for 6 years afterwards, in line with bookkeeping requirements. We will not share this information with third parties except as required by law."
2. Store tenant records securely. A password-protected spreadsheet is a starting point, not the bar. Real digital storage — or paper in a locked drawer — is the bar.
3. Don't share tenant data in group chats. This includes WhatsApp groups of landlords, photos of leases on Facebook, or sharing a tenant's contact with a contractor without first checking with the tenant.
4. Keep a deletion calendar. When a lease ends and 6 years have passed, delete the records. Set a reminder.
5. Update records promptly when tenants tell you something changed — new phone number, new emergency contact. Accuracy is part of the Act.
6. If a tenant asks what you have on them, show them. This is a "data subject access request" and you have to respond to it, in writing, within a reasonable time.

Three things landlords do that are actually violations

1. The all-tenants WhatsApp group. Putting all your tenants in one group exposes every tenant's number to every other tenant. Without their consent, this is a sharing-without-consent violation. Use broadcast lists instead — tenants don't see each other.
2. Posting "X owes rent" in landlord Facebook groups with a photo of the tenant's ID. Don't do this. Ever. Even if you're frustrated. Even if you're right. This is the single fastest way to attract a DPC complaint.
3. Keeping ex-tenant data forever "just in case." If they moved out 5 years ago, you don't need their references anymore. Once your bookkeeping period passes, delete.

Next action

This week: review your lease template. Add the data clause if it's missing. Audit any WhatsApp group with multiple tenants. Move on to the rest of the checklist next month.

The Data Protection Act isn't a high bar to clear, but it is a real one. The Commission's recent posture has been informal warnings for small landlords, fines for repeat or serious violations. Don't be the example they make.

Informational — not legal advice. For your specific situation, consult a Ghanaian property lawyer.