Contents
On 12 October 2026 a Data Protection Commission team walked into five institutions in Accra. One was a clinic. It had no data protection supervisor, fees outstanding since at least January 2025, and had never carried out a privacy impact assessment of the electronic system holding its patients’ records. The Commission directed its representatives to give a statement to the police (Graphic Online, 13 October 2026; MyJoyOnline, 22 October 2026).
The clinic had a records system. That was not the problem. The problem was that nobody could show what had been decided about it before patients went into it.
If you run a clinic, a dental practice, a diagnostic laboratory or a wellness practice in healthcare and wellness, that is the question now in front of you — not whether to digitise the register, which most practices already have, but whether the thing you bought can produce evidence when somebody asks. The rules differ sharply between Ghana and Kenya: a system that satisfies one can be unlawful in the other.
What is happening?
Ghana’s Data Protection Commission has moved from education to inspection. Its Executive Director, Dr Arnold Kavaarpuo, said the Commission has made 2026 a year of enforcement and that it “cannot rely indefinitely on education and persuasion alone”. Of the five health, education and financial institutions inspected on 12 October, only one met the requirements assessed; the rest had certificates that had expired, renewals unfinished or payments outstanding. Checks continue week on week and into 2027 (3News, 14 October 2026). His sharpest line: “An organization may have a registration certificate and still fail to meet its obligations.”
The statute is narrower than the enforcement practice. Under the Data Protection Act, 2012 (Act 843), a controller intending to process personal data shall register (section 27), registration renews every two years (section 50), and an unregistered controller shall not process personal data at all (section 53) — doing so is an offence carrying up to 250 penalty units, up to two years’ imprisonment, or both (section 56). Health data is special personal data, so processing is prohibited unless it is necessary or the patient consents (section 37), and section 28 requires the controller to identify foreseeable risks, maintain safeguards and verify that they work. Section 58 says a controller may appoint a certified data protection supervisor — permissive in the Act, expected in the inspections.
Kenya runs a different architecture, with a residency rule most clinics have never read. Under the Data Protection (General) Regulations, 2021 (Legal Notice No. 263, gazetted 31 December 2021), regulation 26 requires processing for purposes of strategic state interest to run “through a server and data centre located in Kenya”, or to store “at least one serving copy” in a Kenyan data centre. Regulation 26(2)(f) names one such purpose as the “provision of primary or secondary health care for a data subject in the country”. A Nairobi clinic hosted only in Frankfurt or Johannesburg is not expressing a preference. It is outside the regulation.
Kenya has also started awarding money. On 16 March 2026 the Office of the Data Protection Commissioner ordered St Luke Orthopaedic & Trauma Hospital in Eldoret to pay KSh 525,000 to a patient twice given another patient’s test results, whose samples had also gone to an external laboratory. It found unlawful disclosure of sensitive health data, a failure of transparency and insufficient technical and organisational measures — and held that verbal consent, without documented proof, does not meet the legal threshold for processing sensitive personal data (TechTrends Kenya, 16 April 2026).
What remains uncertain. The clinic is not named, and the inspection is reported by newspapers rather than a Commission release. Whether a privacy impact assessment is a free-standing duty in Ghana is not clear from Act 843; the nearest provisions are section 28 and the assessable-processing regime in section 57. Kenya’s registration thresholds and the 24-month validity of a certificate we took from a practitioner reading of Legal Notice 265, not the gazette.
Why it matters economically
The fines are not the exposure: 250 penalty units will not close a practice, and KSh 525,000 is a bad month rather than a fatal one. The exposure is the standstill. Ghana’s section 53 says an unregistered controller shall not process personal data, so a clinic whose certificate has lapsed is not exposed on one record: its basis for running the appointment book, the billing file and the laboratory referrals is in question across the whole base.
Consent works the same way. The Kenyan determination did not find one defective form, it found that undocumented consent does not clear the threshold — so a practice that has always taken consent verbally has an evidential gap the size of its patient list. These failures do not scale with the incident. They scale with the record base, because the defect is in the process, and it touched every patient.
Kenya’s regulation 26 is the one line item with a visible price: requiring a serving copy in a Kenyan data centre changes the vendor shortlist, the monthly bill and sometimes the product. The rest of the cost is the owner’s and the practice manager’s hours, taken out of room time.
What it means for African businesses
This is a two-market piece and should not be read as a continental one. Ghana’s position rests on Act 843 and an enforcement programme that is live now; Kenya’s on the Data Protection Act, 2019, its 2021 Regulations and a regulator issuing determinations with money attached. Nigeria, South Africa and Egypt have their own instruments and timetables, as our piece on Egypt licensing the use of personal data shows across African markets.
Who is affected: any practice holding a patient record, on paper or not — Act 843 regulates processing, not screens. Who carries the heaviest version: anyone on a cloud product, which adds a processor, usually a cross-border transfer, and in Kenya a residency test. Who is not: a Ghanaian clinic faces no residency rule at all, which is why a group operating in both markets cannot run one hosting policy across them.
Clinics in Accra and Nairobi commonly run on a shared front-desk machine, bookings by message and patchy connectivity. Those are design constraints, not deficiencies — and the reason individual logins matter, because a shared account cannot answer who opened a record.
Technology and AI implications
A records system carries part of this: consent as a dated, attributable field rather than a paper slip; individual logins and role-based access, so a receptionist cannot read clinical notes; an access log; and a retention rule that actually deletes, which section 24 of Act 843 requires in substance. Most products sold into African health markets support that.
What technology cannot do is the larger part. No system registers you with a regulator, supplies a lawful basis, or appoints your supervisor. A vendor’s compliance claim is the vendor’s: in both markets the duty sits with the controller. The assessment the Accra clinic lacked is written judgement about risk, and nothing in a software catalogue produces it.
AI deserves a flat answer: here it mostly makes things harder. An AI scribe, a triage chatbot or an imaging aid increases the volume and sensitivity of what you process, inserts another processor and usually sends data across a border. In Ghana that is more special-category processing to justify; in Kenya it collides with regulation 26. Make the record base lawful first and add the model afterwards. A clinic that deploys AI on an unregistered, unassessed system has not modernised. It has enlarged the problem.
Practical business implications
Six questions, answerable in an afternoon.
- Is the registration current, the expiry diarised and the fees paid? Ghana renews every two years, Kenya’s certificate runs 24 months. Arrears from January 2025 were part of what sent one clinic to a police statement.
- Who is the named person? Appoint a supervisor or officer in writing, even where the statute says “may”.
- Has the records system been assessed, in writing and dated? If it is already live, assess it now rather than let an inspection establish that you never did.
- Where does the data physically sit? Get the hosting region from the vendor in writing, and in Kenya test it against regulation 26.
- Can you produce a patient’s consent, and the log of who opened their record? Undocumented consent was the finding in Eldoret, where an administrative error was read as inadequate measures rather than an excuse.
- Who else receives the data, and what is the deletion rule? A laboratory, a billing bureau, an insurer, a scheme — each is a disclosure needing a basis and a contract. Keeping records past their purpose is its own breach, under section 24.
RevenueStack perspective
Our view is that both regulators have, without saying so, repriced clinical record-keeping. It used to be a purchase: buy the software, migrate the register, done. It is now a standing operating cost — a renewal, a named person, a dated assessment, a hosting decision, a consent artefact per patient. A practice that still treats the system as a bought asset pays the cheap price now and the dear one later.
The more useful observation is that this cost is not pure overhead, and reading it that way is the common mistake. A clinic’s economics are recall and repeat: room time is the capacity, and the cheapest demand it owns is the patient it has already treated. Almost every artefact the regulator wants is one that recall needs. Documented consent with a communication preference is what makes a reminder lawful rather than a complaint, and deduplicated patient identity is what stops two records for one person — which produced the wrong test result in Eldoret, and which quietly breaks a recall list.
So the sequencing is not compliance first and growth later. It is one build: a single patient record with consent, identity, access and retention designed in, serving the inspection and Tuesday morning’s clinic at once. That is a CRM and business systems problem in everything but name, and the discipline behind it is set out in our approach. The practices that find this cheap build the register once and keep one version of the truth.
Conclusion
The clinic in Accra was not caught without a records system. It was caught unable to show what it had decided about one. In Ghana that means inspection without notice and, in one case, a statement to the police; in Kenya a determination with money attached and a rule limiting which products a clinic may lawfully use. The response is not a procurement exercise. Write down what you hold, why, where it sits and who can see it — then make the system prove it, because the evidence that satisfies a regulator is the evidence that fills next week’s clinic.
Sources
- Data Protection Commission clamps down on organisations breaching regulations, microfinance firm and health facility referred to police for prosecution — Graphic Online, 2026-10-13
- Data Protection Commission steps up compliance checks across key Ghanaian institutions — 3News, 2026-10-14
- Ghanaian clinic stored patient records on an unassessed system before regulator intervened — MyJoyOnline, 2026-10-22
- Data Protection Act, 2012 (Act 843) — Data Protection Commission, Ghana, 2012-05-18
- The Data Protection (General) Regulations, 2021 (Legal Notice No. 263), Kenya Gazette Supplement No. 236 — Government of Kenya, 2021-12-31
- Eldoret Hospital Ordered to Pay KSh 525,000 Over Patient Data Breach — TechTrends Kenya, 2026-04-16
- Navigating the Data Protection Laws in Kenya: A Guide to Registering Data Controllers and Data Processors — CFL Advocates