Cameras record people, and recordings of identifiable people are personal data. In Ghana that brings them under the Data Protection Act, 2012 (Act 843), overseen by the Data Protection Commission. This is a practical overview, not legal advice; check your own situation with the Commission or a lawyer.
Register as a data controller
Act 843 requires organisations that process personal data to register with the Data Protection Commission. If your business runs CCTV, the footage is part of what you process, so include it when you register or renew.
Tell people they are being recorded
The Act expects people to know when their data is being collected and why. For CCTV, the practical way to do that is clear signage at entrances and in covered areas, saying that cameras are in use, who operates them and how to contact you.
Record only what you need
Point cameras at what you are protecting: gates, tills, stores, server rooms. Avoid areas where people expect privacy, such as washrooms and changing rooms, and avoid capturing neighbouring property more than you must.
Keep footage no longer than necessary
The Act says personal data should not be kept longer than the purpose needs. Set a retention period that matches your reason for recording, often a few weeks, and let the recorder overwrite automatically. Keep a clip longer only when it relates to an incident.
Control who can see it
- Give each person their own login on the recorder, never a shared admin password.
- Change the default password on installation.
- Keep the recorder in a locked room or cabinet.
- Keep a simple log of when footage is exported, and to whom.
Be ready for a request
People have a right to ask for data held about them. Decide in advance who handles such a request and how you would find and export the relevant footage.