Nyaho Medical Centre ordered to report to CID over expired data protection certificate

Nyaho Medical Centre has been directed to report to the Criminal Investigations Department (CID) of the Ghana Police Service to provide a statement over the expiry of its data protection certificate.

The directive was issued following an enforcement operation by the Data Protection Commission (DPC) on Monday, October 12, 2026, as part of efforts to ensure that organisations comply with Ghana’s data protection requirements.

The Commission has flagged the healthcare facility, located in Accra’s Airport Residential Area, over its expired certificate. Investigations are expected to establish the circumstances surrounding the lapse and determine whether the facility has met its regulatory obligations.

The development raises concerns about compliance with data protection requirements in the healthcare sector, where facilities handle sensitive personal information, including patients’ medical histories, diagnoses, contact details and treatment records.

Under the Data Protection Act, 2012 (Act 843), organisations that collect and process personal data are required to comply with applicable registration and data protection obligations.

The DPC is responsible for overseeing compliance with Ghana’s data protection framework and ensuring that organisations handling personal information meet the relevant legal requirements.

However, details about how long Nyaho Medical Centre’s certificate has been expired remain unclear. The Commission has also not disclosed further findings against the facility or indicated whether the investigation could result in additional regulatory or legal action.

Nyaho Medical Centre’s response to the directive was not immediately available.

Further details are expected as investigations continue.