The Data Protection Commission (DPC) has begun an enforcement drive, moving away from solely relying on education and persuasion to ensure compliance with data protection regulations. The Executive Director, Dr Arnold Kavaarpuo, stated that 14 years after the Data Protection Act, 2012 (Act 843), was passed, organisations must adhere to legal obligations regarding the collection, use, storage, and protection of personal information. During an exercise in Accra, the DPC found two hospitals operating with expired data protection certificates and a clinic with outstanding fees and other compliance issues. The microfinance company failed to renew its registration and complete a compliance report. Representatives of the company are expected to report to the Criminal Investigations Department (CID) headquarters for possible prosecution. The clinic had not appointed a Data Protection Supervisor, had unpaid fees, and lacked adequate measures to protect sensitive patient information. The DPC warned that non-compliance could lead to personal data misuse, including sale to third parties and use in scams. Inspections are set to continue into 2027.