Lewis SelbyCo-Founder, Maxme7 min read
Yes, most likely. Ghana's Data Protection Act, 2012 (Act 843) says a data controller who intends to process personal data must register with the Data Protection Commission, and the Commission says all entities that process personal data must. A shop that keeps customer names, phone numbers and delivery addresses is processing personal data. Fees start at GH¢ 156 for small businesses and startups.
Who has to register with the Data Protection Commission?
Section 27(1) of the Data Protection Act, 2012 (Act 843) says a data controller who intends to process personal data shall register with the Commission. The Commission's registration page goes wider: it says all entities involved in processing personal data are required to register, including data controllers, data processors, foreign companies processing personal data in Ghana, businesses, and public and private institutions.
The Commission's FAQ describes a data controller as a person who decides, alone or with others, why and how personal data is processed. An online seller decides why it keeps a buyer's name, number and address, which is to deliver the order. That is our plain reading of the definition, not wording from the Commission, so ask the Commission on its registration line if you are unsure.
We found no published exemption for small sellers or sole traders. The Commission's fee list has a tier for small businesses and startups, which suggests that small businesses are expected to register.
What happens if you do not register?
Section 56 of the Act says a person who fails to register as a data controller but processes personal data commits an offence. On summary conviction the penalty is a fine of not more than 250 penalty units, a prison term of not more than two years, or both.
The Commission's registration page adds that an unregistered data controller is prohibited from processing personal data under section 53, and that it can issue a stop order. The Commission's FAQ says it can take enforcement action and fine non-compliant data controllers, without giving amounts.
How do you register?
The Commission says registration is done through its online portal, and it publishes step-by-step manuals. Its page sets out four steps: submit the application, provide the required information, pay the fee for your sector classification, and once complete your business is listed in the Data Protection Register.
Have this ready, from the Commission's list of required information:
- Your business name and address
- A description of the personal data you process and the categories of people it concerns
- Whether you process special categories of personal data
- The purpose of the processing, and who receives the data
- The countries you may transfer data to
- A general description of your data security measures
How much does registration cost?
The Commission's FAQ says fees are based on the size and nature of your organisation, and lists four tiers. These are the figures on the FAQ at the time of writing (October 2026):
The full Fees and Charges schedule is a separate PDF linked from the FAQ. We could not read it, because it is a scanned image with no text layer, so we do not quote anything from it beyond the four tiers above. Read it to see which tier your business falls into, or ask the Commission.
| Tier | Fee |
|---|---|
| Small businesses and startups | GH¢ 156 |
| Medium entities | GH¢ 1,170 |
| Large entities | GH¢ 2,340 |
| Specialised industries | GH¢ 5,000 |
How long does registration last, and how do you renew?
The Commission's pages do not say how long a registration lasts, so check the date on your registration. They do give the renewal rules: the portal lets you renew from three months before expiry, up to 7 days after it, and the Commission says to submit the renewal application 3 months before expiry.
Renewing needs a compliance report, which you must request from the Commission because the page gives no template, plus any changes to what you first told it, such as an updated number of data subjects or a new Data Protection Supervisor. The Commission says failing to renew can lead to non-compliance penalties and removal from the Register. Appointing a supervisor is optional under section 58.
What rules apply to the customer details in your shop?
Registering is the start. The Act also sets rules for what you do with the data. Section 20 says you shall not process personal data without the person's prior consent unless an exception applies, such as the data being necessary for a contract the person is party to. A delivery order falls under that contract exception, but a marketing list does not, so ask before you add anyone to one.
Section 27(2) says that when you collect personal data, the person must be told what data you are collecting, who is collecting it, why, and who receives it. Put that on your checkout page in plain words. Section 19 says you may only process data that is necessary, relevant and not excessive, so do not ask for a birth date to sell a phone case. Section 24 says do not keep records longer than needed unless the law, a contract or consent allows it.
Section 28 requires reasonable technical and organisational measures against loss and unauthorised access. In a shop that means unique logins for staff, no customer lists passed around in open chat groups, and a plan for a lost phone. If someone gets at the data without permission, section 31 says you must tell the Commission and the affected people as soon as reasonably practicable.
People can ask what you hold on them. Section 32 lets a person with proof of identity ask a controller to confirm whether it holds their data, describe it and correct it. Our guides 'How to sell on WhatsApp Business in Ghana: from Status to MoMo' and 'How to sell on Instagram in Ghana: from DM to WhatsApp to MoMo' cover the consent rules for direct marketing and posting customer content.
Where does this fit in your store setup?
Register early in your launch plan, next to the other papers a shop needs. Payment providers and Meta also ask for business papers, so our guides 'How to open a Paystack account in Ghana: Starter or Registered' and 'How to verify your business on Facebook in Ghana (2026)' are worth reading in the same week.
Maxme Store Launch, our own price: GHS 5,000 (about US$430) on WooCommerce or GHS 6,000 (about US$517) on Shopify, one-off and excluding VAT; see our pricing page. Maxme's free Ads & Store Audit also checks your checkout page and sends a short video on WhatsApp within 2 working days. This guide is general information, not legal advice, so ask the Commission or a lawyer about your own case.
