The Data Protection Commission (DPC) has acquired two new pickup vehicles to strengthen its enforcement operations and expand its activities across the country.

The vehicles, purchased with the Commission’s Internally Generated Funds (IGF), will support field operations and the planned establishment of regional offices to improve compliance with Ghana’s data protection laws.

Deputy Minister of Communications, Digital Technology and Innovations, Mohammed Adams Sukparu, presented the vehicles to the Commission at a ceremony in Accra on Thursday.

Speaking to the Ghana News Agency after the presentation, Executive Director of the DPC, Dr Arnold Kavaarpuo, said the Commission had designated 2026 as the “Year of Enforcement” to ensure that institutions comply with their obligations under the Data Protection Act, 2012 (Act 843).

He explained that public and private institutions that process or intend to process personal information are required to register with the Commission.

Dr Kavaarpuo, however, stressed that compliance goes beyond registration, with institutions expected to establish appropriate policies and safeguards to protect personal information.

These include conducting vulnerability and penetration assessments where necessary, as well as data protection impact assessments for significant data-processing activities.

He said the Commission would pay particular attention to sensitive information, including children’s data, health records and information with potential national security implications.

Dr Kavaarpuo also cautioned educational institutions against using images of children for promotional purposes without obtaining the necessary consent.

“Those students are there to school. They are not marketing objects,” he said.

On health data, he said the DPC would intensify scrutiny of how institutions collect, store, access and share such information because of its sensitive nature.

According to him, the Commission initially faced challenges with its enforcement drive because limited public awareness meant some institutions only became aware of the regulator after enforcement action had commenced.

He said the DPC had therefore incorporated public education into its enforcement activities to deepen understanding of the law and encourage voluntary compliance.

The Commission also expects its planned regional expansion to improve access to its services, particularly for individuals seeking redress following data breaches or the misuse of their personal information.

Dr Kavaarpuo stressed that data protection should also be treated as a national security concern, given the risks posed by identity theft, unauthorised access and other threats to Ghana’s data infrastructure.

“Data is as much a national security imperative as it is a commercial or personal nature,” he said.

The Data Protection Commission was established under the Data Protection Act, 2012 (Act 843), in line with the constitutional right to privacy.

It is responsible for regulating the processing of personal information, promoting compliance with data protection requirements and protecting individuals against the misuse of their personal data.