Ghana’s AI and Deepfake Rules: What the New Data Protection Bill Means

Ghana’s proposed data-protection reform is part of a much broader attempt to govern a rapidly expanding digital economy.

On 2 March 2026, Communications, Digital Technology and Innovations Minister Samuel Nartey George announced that the government was developing a new Data Protection Bill. The proposed legislation is intended to address artificial intelligence, automated decision-making and cross-border data transfers, while strengthening enforcement and citizens’ rights.

The announcement also identified a second legislative initiative: an Emerging Technologies Bill intended to establish a structured framework for artificial intelligence, advanced analytics, digital assets and other emerging platforms.

At the time, Ghana’s AI strategy was still being prepared. That position has since changed. On 24 April, President John Dramani Mahama officially launched the National Artificial Intelligence Strategy for 2025–2035, setting out a ten-year ambition to develop domestic AI capacity and position Ghana as a competitive participant in the global technology economy.

The legislative process has also progressed beyond the initial consultation stage. Ghana’s Business Regulatory Reform portal records that consultations on the draft Data Protection Bill ran from 17 October to 28 November 2025, while the Emerging Technologies Bill consultation ran from 16 October to 19 December 2025. Both are marked closed. On 5 June 2026, the Communications Ministry said it was reviewing ten Cabinet memoranda and current draft bills with relevant agencies, legal teams and representatives of policy organisation IMANI Ghana.

But a closed consultation is not an enacted law. Nor does the June review establish that either bill has completed Cabinet approval, been formally introduced in Parliament or received presidential assent.

As of 21 October 2026, the latest publicly available evidence reviewed for this article does not establish that either proposed bill has become law.

That distinction is central to the story. Ghana has published a national AI strategy, circulated draft legislation and begun enforcing existing data-protection requirements more actively. Those are related developments, but each has a different legal status.

The relationship between artificial intelligence and data protection is often misunderstood.

AI systems can be trained on large datasets, analyse personal information, generate profiles, infer characteristics and produce recommendations that influence decisions about individuals. A system does not need to make a final decision itself to affect someone’s access to credit, employment, healthcare or public services.

These risks become more complicated when data moves between organisations, cloud platforms and countries.

Consider an AI-enabled lending platform. It may process identity information, financial records, transaction histories, telephone numbers and behavioural data. It may also use automated scoring to decide whether an applicant qualifies for a loan.

Several distinct regulatory questions arise:

• Was the information collected lawfully, and is its use consistent with the applicable legal basis?

• Is the data sufficiently accurate and secure?

• Can an applicant challenge an inaccurate profile or an adverse decision?

• Which organisation is responsible when a third-party model produces a harmful result?

• If the data is processed abroad, what safeguards and transfer requirements apply?

These are not exclusively AI questions. They are also questions of privacy, consumer protection, accountability and access to essential services.

Ghana’s Data Protection Act, 2012 (Act 843) already establishes obligations for organisations that process personal data. The proposed replacement is intended to modernise this framework for a digital environment in which large-scale analytics, machine learning and international processing are increasingly common.

At the March conference, the government identified stronger enforcement, clearer international-transfer rules and expanded citizens’ rights as key objectives. The minister also connected data protection to confidence in digital financial services, interoperable payments, public digital infrastructure and open banking.

The underlying economic argument is important: a digital service can be technically sophisticated and still fail if people do not trust the way it uses their information.

The official consultation record describes the draft Data Protection Bill, 2025 as legislation intended to establish a Data Protection Authority and regulate personal-data processing. Its listed subject areas include data-protection principles, data-subject rights, special personal data, registration, accreditation of service providers, sanctions and international transfers.

A July 2026 corporate-law outlook published by Ghanaian law firm Bentsi-Enchill, Letsa & Ankomah identifies several proposed changes:

• Establishment of a Data Protection Authority with enhanced enforcement powers.

• Expanded scope covering certain organisations outside Ghana that offer goods or services to people in the country or monitor their behaviour.

• Additional data-subject rights, including data portability and erasure.

• Conditions for international data transfers, including consent, necessity and appropriate safeguards.

• Greater powers to issue corrective measures, impose administrative fines and direct cooperation with sector regulators.

These are proposals described in the draft and legal analysis, not a statement of rights or powers already created by the new bill.

The distinction matters particularly for international technology companies. If the proposed territorial scope is retained, some businesses based outside Ghana could face obligations because of their activities involving people in the Ghanaian market. The eventual wording, exemptions and implementation rules will determine precisely which organisations are covered.

The draft’s potential expansion of individual rights could also change the way businesses handle information requests, deletion demands and the portability of personal data. That would have implications for customer-management platforms, digital lenders, telecommunications companies, online marketplaces and AI service providers.

For companies using AI, however, the bill’s significance extends beyond adding more rights to a privacy notice. The proposed framework would place data governance, accountability and international processing within a more comprehensive regulatory system.

The final text will determine how these duties interact with AI development and deployment, and how the regulator will exercise its powers.

The Data Protection Bill is not the only proposed instrument relevant to AI.

The draft Emerging Technologies Bill, 2025 is designed to establish an Emerging Technologies Agency and create a harmonised set of rules concerning technology development, rights, ethics and safety. Its scope includes artificial intelligence and other technologies such as blockchain, cloud computing, the Internet of Things and quantum computing.

The publicly available draft contains 37 sections, including proposed principles covering:

• Integrity of democratic processes and the rule of law.

• Discrimination and bias.

• Transparency and oversight.

• Personal-data protection.

• Consumer protection.

• Accountability and reliability.

• Risk and impact management.

• Human oversight.

• Misinformation and disinformation.

• Security and environmental safeguards.

• Intellectual property and access to redress.

The draft is significant because it treats AI as more than a privacy problem. A system can comply with certain data-protection requirements and still create risks through discriminatory outputs, unsafe recommendations, deceptive content or a lack of meaningful human review.

The bill proposes that systems undergo risk and impact management and that human intervention or review be available for decisions substantially affecting people’s rights, including decisions involving health, law enforcement, employment and elections.

It also contains a provision stating that emerging-technology systems should not spread false information, including technology-generated misinformation and disinformation.

These provisions could create a broader legal basis for addressing AI-related harms if they survive the legislative process. But their eventual reach will depend on the final statutory language, definitions, exceptions, enforcement powers and implementing regulations.

There is also an institutional question. The draft proposes an Emerging Technologies Agency, while the data-protection reforms envisage a separate Data Protection Authority. The two bodies would need clearly defined responsibilities and effective coordination to prevent overlapping investigations, conflicting directions or uncertainty about which regulator leads in a particular case.

Deepfakes are synthetic or manipulated audio, images or video that can make a person appear to say or do something they did not say or do. Generative AI can also be used to imitate voices, fabricate identities or combine publicly available information into convincing impersonations.

Their risks extend beyond misinformation.

A synthetic voice can be used in a financial scam. A fabricated video can damage a person’s reputation. An impersonation can undermine confidence in public communications. Manipulated intimate imagery can be used to harass or intimidate a victim.

In these cases, the harm may involve privacy, fraud, reputational damage, harassment, consumer protection or the integrity of public information. One incident can raise several legal questions at once.

Ghana’s March announcement linked the proposed Data Protection Bill to AI and deepfakes. The Ghana Chamber of Telecommunications subsequently reported that the reforms were intended to bring AI systems, automated decision-making, deepfakes and cross-border transfers under more formal oversight.

However, the distinction between the bills is important. The draft Data Protection Bill addresses the processing and protection of personal data, while the separate Emerging Technologies Bill contains explicit provisions on technology-generated misinformation and disinformation. The government’s wider legislative programme also includes a draft Misinformation, Disinformation, Hate Speech and Publication of Other Information Bill.

It would therefore be inaccurate to assume that every deepfake-related issue will be governed exclusively by the Data Protection Bill.

The applicable rules may depend on what the content depicts, whether identifiable personal data is involved, how it was created or distributed, whether it is fraudulent or defamatory, and whether it violates other existing laws.

A fabricated video of a public official, for example, may raise questions about misleading information and the integrity of public debate. A synthetic voice used to obtain money through impersonation may raise different questions about fraud and cybersecurity. Non-consensual synthetic intimate imagery can raise serious privacy and gender-based abuse concerns.

The legal response needs to distinguish these cases rather than treat all synthetic content as one category.

This is especially important for legitimate uses of generative AI, including satire, artistic expression, film production, accessibility tools and clearly labelled fictional content. A workable framework must address harmful conduct without making the mere use of synthetic media equivalent to wrongdoing.

The core regulatory challenge is to establish clear rules around consent, deception, harm, accountability and remedies, while providing enough precision that people and businesses can understand what is prohibited.

While the proposed reforms remain under development, Ghana’s existing data-protection regime is not on hold.

The Data Protection Commission has announced a shift towards stronger enforcement of the Data Protection Act, 2012. In an October 2026 report, the Ghana News Agency said the Commission would conduct spot checks, inspections, investigations into complaints and verification of registration status.

The checks began on 5 October, according to the Commission’s announcement reported by GNA. The stated targets include organisations that have failed to register or meet other statutory requirements.

On 12 October, the Commission reiterated its enforcement approach and warned public and private institutions against processing personal information without fulfilling their legal obligations.

The Executive Director, Dr Arnold Kavaarpuo, also highlighted the growing risk of AI-enabled impersonation. He cited a Cyber Security Authority report indicating that nearly GH¢10 million was lost to online fraud during the first six months of 2026, while clarifying that the entire amount could not be attributed to data-protection breaches.

That qualification matters. The fraud figure is evidence of a wider digital-risk environment, not proof that data-protection violations caused every loss.

The Commission also stated that processing personal data without required registration is an offence under Section 56 of Act 843, punishable upon summary conviction by a fine, imprisonment for up to two years, or both. The exact application of sanctions depends on the law and the facts of each case.

For businesses, this creates an immediate compliance priority. Organisations should not wait for the new bill before checking whether they are properly registered, have lawful grounds for processing personal data, protect it against unauthorised access and maintain appropriate internal procedures.

The regulatory direction is clear: Ghana is seeking to strengthen the practical enforcement of existing obligations while preparing a more modern framework for emerging risks.

Cross-border data transfers are among the most commercially consequential parts of the proposed reforms.

Modern digital services rarely operate within a single national boundary. A Ghanaian business might collect information locally, store it through a cloud provider in another country, use a model hosted elsewhere and rely on an international supplier for customer support or analytics.

This creates a chain of processing relationships. The location of the customer-facing company does not necessarily reveal where data is stored, accessed, transferred or analysed.

The proposed Data Protection Bill aims to clarify the rules governing international transfers and introduce specified conditions and safeguards. The precise requirements will depend on the final text.

For businesses, the implications could extend to vendor contracts, cloud architecture, outsourcing arrangements, data-retention policies and the use of external AI services.

Organisations will need to understand what information is transferred, the purpose of the transfer, the parties receiving it and the safeguards that apply. They will also need to distinguish between storing information abroad and allowing a third-party service to process it, while assessing the legal consequences of each arrangement.

Ghana’s emphasis on digital sovereignty is part of the same discussion. At the March conference, parliamentary leadership described control over data, digital systems and national identity as increasingly important to national sovereignty.

But digital sovereignty does not automatically require all data to remain within national borders. A country can seek enforceable rights over how its residents’ information is handled while continuing to participate in international research, cloud computing, digital trade and technology investment.

The policy challenge is to make safeguards effective without imposing unnecessary barriers on legitimate data flows.

Excessively unclear transfer rules could raise costs for smaller businesses and complicate regional service delivery. Clear and predictable safeguards could instead help customers, investors and partners understand the conditions under which data can be processed.

For Ghana, this is a question of both protection and competitiveness.

The regulatory debate is taking place alongside an ambitious programme to expand Ghana’s domestic AI capacity.

The National AI Strategy for 2025–2035 was officially launched in April. The government has described it as a roadmap for developing local capabilities, expanding responsible AI adoption and supporting applications across sectors such as healthcare, agriculture, education and public services.

At the launch, President Mahama announced plans for a US$250 million AI Computing Centre and a separate US$20 million commitment to support short- to medium-term implementation of the strategy.

By September, the Communications Minister was reporting that implementation had begun. According to Ghana Business News, 247 public-sector personnel had received AI training, and the government had introduced performance indicators to track AI adoption across ministries, departments and agencies.

The minister also cited Publican AI, an AI-enabled system deployed by the Ghana Revenue Authority, saying it had increased revenue collection at ports by approximately US$4 million per day. That is a government-reported result; independent verification and a detailed methodology would be needed to assess how much of the reported increase was attributable to the system.

The strategy’s significance is that Ghana is not approaching AI solely as a risk to be contained. It is also treating the technology as an economic capability to be developed.

That creates a regulatory balancing act. A framework that is too weak may leave people exposed to data misuse and harmful automated decisions. One that is difficult to interpret or disproportionately expensive to comply with may discourage smaller developers and local businesses from adopting AI responsibly.

A proportionate approach can help resolve this tension by distinguishing between low-risk experimentation and systems that have significant effects on people’s rights or access to services.

In September, the minister explicitly described the government’s objective as regulating AI risks without stifling innovation, highlighting the difference between low-risk experimentation by students and high-risk systems used in lending or other critical decisions.

The emerging legal framework will need to translate that policy principle into practical obligations, including clear responsibilities, proportionate assessments and accessible guidance for smaller organisations.

A modern regulatory framework needs more than a list of principles. It needs institutions that can apply those principles consistently.

Ghana’s proposals point towards a system in which a new Data Protection Authority would oversee personal-data issues and an Emerging Technologies Agency would support the governance and development of emerging technologies. The wider system also involves existing bodies responsible for cybersecurity, communications, consumer protection and sector-specific supervision.

That division can be sensible because different harms require different expertise. A data-protection authority may be best placed to assess unlawful processing, while a cybersecurity body may have the technical expertise to investigate a compromised system. A sector regulator may understand the operational risks of AI in banking or healthcare.

But overlapping mandates can create uncertainty if the final laws do not clearly establish who leads an investigation, which authority can issue binding directions and how conflicting decisions are resolved.

Consider a lender that uses an AI model supplied by an overseas vendor. If the system processes personal information unlawfully, produces discriminatory outcomes and suffers a security breach, several legal regimes could be relevant at the same time.

The lender, model provider, data processor and relevant regulators may each have different responsibilities. Effective enforcement requires those responsibilities to be clear enough that accountability does not disappear between institutions or contractual relationships.

The proposed bills will also need to establish fair procedures for complaints, investigations, corrective measures and appeals. These are important both for protecting individuals and for giving businesses predictable rules.

The institutional design should be judged by whether people can obtain remedies, organisations can understand their duties and regulators can coordinate effectively—not simply by the number of agencies created.

The proposed reforms are not a reason to assume that every new requirement is already legally binding. They are, however, a reason for businesses to assess their exposure and improve their readiness.

For all organisations handling personal data:

• Verify registration and renewal obligations under the existing Data Protection Act.

• Review the legal grounds and purposes for collecting and using personal information.

• Check access controls, retention practices, security procedures and incident-response arrangements.

• Review contracts with data processors and external service providers.

• Map international data transfers and the safeguards applicable to them.

For organisations using AI:

• Maintain an inventory of AI systems used internally or supplied to customers.

• Identify systems that influence consequential decisions involving credit, employment, healthcare, education or access to services.

• Document testing, accuracy limitations, known risks and human-review procedures.

• Check whether training and operational datasets contain personal or sensitive information.

• Clarify who is responsible for monitoring, investigating and correcting harmful outcomes.

For organisations developing or distributing synthetic media:

• Establish clear procedures for consent, identity verification and handling complaints.

• Consider how AI-generated content is labelled or disclosed where appropriate.

• Assess risks involving impersonation, fraud, harassment and misleading representations.

• Preserve relevant records when investigating suspected misuse.

• Ensure that responses to harmful content are consistent with applicable law and respect legitimate uses of synthetic media.

These measures are sensible preparation, not a claim that every item is a new statutory requirement under a bill that has yet to be enacted.

The final legislation, commencement provisions and implementing regulations will determine which additional duties apply and when.

What to watch next

Several developments will determine how far Ghana’s announced reforms translate into enforceable rules.

The final Data Protection Bill. Businesses and individuals need the authoritative text to assess the final scope of the Data Protection Authority, new rights, penalties and international-transfer requirements.

The Emerging Technologies Bill. The key questions include the proposed agency’s powers, the treatment of high-impact AI systems, the meaning of human oversight and the enforcement of provisions concerning misinformation and disinformation.

The relationship with other laws. Ghana’s wider legislative programme includes a draft misinformation bill and other digital-sector reforms. The final instruments will need to clarify how they interact with existing privacy, cybersecurity, consumer-protection and criminal laws.

Implementation and enforcement. The Data Protection Commission’s October checks show that enforcement of the current law is already a practical concern. The effectiveness of any new system will also depend on staffing, technical capacity, guidance and consistent regulatory decisions.

Support for local AI development. The government’s computing infrastructure, skills and AI-adoption plans will need to develop alongside the regulatory framework, so that local businesses can meet their obligations without being shut out of responsible innovation.

The next milestone is not simply the announcement of another bill. It is the publication and advancement of authoritative legislative texts, followed by clear implementation arrangements.

Ghana’s proposed Data Protection Bill has become a focal point in a wider regulatory transition. It is intended to modernise personal-data protection, clarify international transfers and strengthen enforcement as AI becomes more deeply embedded in finance, communications, public services and commerce.

The separate Emerging Technologies Bill broadens the ambition by addressing risk management, human oversight, discrimination, security, accountability and technology-generated misinformation. Together with the National AI Strategy, these initiatives indicate an attempt to build domestic AI capability while establishing clearer safeguards for its use.

But the legal status remains crucial. The existing Data Protection Act is enforceable today. The National AI Strategy has been launched. The proposed bills remain distinct from enacted law, and their final provisions and legislative progress must be verified before any new obligation is treated as binding.

The most important test will be whether Ghana can turn these initiatives into a coherent system: one that gives people meaningful protection, tells businesses what is expected of them and allows responsible AI development to continue.

Deepfakes may have brought the issue into sharper focus, but the larger question is how Ghana will govern the data, decisions and digital infrastructure on which its next phase of economic development depends.