Ghana DPA 2012 Part Five - Cross-Border + Breach + Enforcement. CROSS-BORDER TRANSFERS (Sec.47): personal data may be transferred outside Ghana only where: (a) ADEQUACY - destination country provides adequate level of protection (DPC determination); (b) APPROPRIATE SAFEGUARDS - binding corporate rules + standard contractual clauses + approved code of conduct + safeguards approved by DPC; (c) DEROGATIONS - explicit consent + contract necessity + public interest + legal claims + vital interests + Ministerial approval for sensitive transfers; (d) ECOWAS regional cooperation: data transfers within ECOWAS member states benefit from regional supplementary act. BREACH NOTIFICATION (Sec.55): controllers must notify DPC of personal data breach without undue delay; for material breaches with risk of harm to data subjects + notification to affected individuals required; documented incident records. ENFORCEMENT (Sec.21-31, Sec.55-65): DPC may issue: (a) information notices; (b) assessment notices; (c) enforcement notices + penalty notices; (d) DPC investigations + audit findings; (e) referral to criminal prosecution for serious offences. ADMINISTRATIVE PENALTIES: per-violation civil penalties from GHS 1,000 to GHS 50,000+ depending on severity + per-day continuing-violation accumulation; CRIMINAL SANCTIONS: up to 10 YEARS imprisonment + significant fines for unauthorised disclosure + commercial misuse + obstruction. APPEALS: to High Court within 30 days. 2024-2025: amendments anticipated to align fine ceilings with GDPR-comparable deterrence + add turnover-based fines.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.