Digital Trade and Data Governance in Africa: Reforming Ghana’s Data Protection Act for Secure Cross-Border Data Flows Under the African Continental Free Trade Area (AFCTFTA) Framework

Abstract

Ghana’s Data Protection Act, 2012 (Act 843) establishes foundational principles governing lawful and secure processing of personal data but provides limited guidance on cross-border data transfers, a regulatory gap that has become increasingly consequential in the context of the African Continental Free Trade Area (AfCFTA). As digital trade, artificial intelligence (AI), and cross-border service delivery expand across Africa, uncertainty regarding international data transfers threatens privacy protection, regulatory compliance, and economic integration. This paper examines how Ghana can reform its data protection regime to enable secure cross-border data flows while safeguarding constitutional privacy rights and national interests. Using doctrinal and comparative legal analysis, the study draws on two contrasting yet complementary models: the ECOWAS Supplementary Act on Personal Data Protection (2010), which prioritises regional harmonisation and mutual recognition, and China’s Personal Information Protection Law (PIPL, 2021), which adopts a sovereignty oriented and risk-tiered approach to outbound data transfers. The paper argues that Ghana should adopt a hybrid regulatory model incorporating presumptive adequacy for regional partners, standard contractual safeguards for international data transfers, and tiered security assessments for high-risk data exports. Such reforms would align Ghana’s data protection framework with AfCFTA digital trade obligations while strengthening the protection of personal data and promoting Africa’s digital economy. This paper thus contributes to Africandigital governance scholarship and advances a scalable framework for reconciling free data flows with privacy, security, and sustainable digital development.