Data Protection in Nigeria and Ghana

Nigeria Data Protection Act 2023, NDPR & Ghana Data Protection Act 2012

In Short

The law: Nigeria and Ghana both have data protection laws that cover patient information.
Your clinic: your clinic decides how it uses its patients' information and stays responsible for that.
MyDentalPractice: holds your clinic's records on your behalf and gives you tools that help.
Tools today: individual sign-ins, role-based access, two-step sign-in, consent forms in the patient file and automatic backups.

1. The Law in Nigeria and Ghana

In Nigeria, the Nigeria Data Protection Regulation (NDPR) was issued in 2019 by the National Information Technology Development Agency (NITDA). The Nigeria Data Protection Act 2023 followed and established the Nigeria Data Protection Commission (NDPC) as the regulator.

In Ghana, the Data Protection Act 2012 (Act 843) established the Data Protection Commission to protect the privacy of individuals by regulating how personal information is processed.

Both laws expect personal information to be used lawfully, fairly and transparently, kept accurate, kept no longer than needed, and protected with suitable security. Health information is treated as especially sensitive.

2. Who Does What

Data roles, in general terms:

Data controller: the organisation that decides why and how personal information is used. For patient records, this is usually your clinic.
Data processor: an organisation that handles personal information on the controller's behalf. MyDentalPractice holds your clinic's records so your team can do its work.

Things a clinic usually looks after under these laws include:

Having a lawful reason for collecting and using each kind of patient information
Getting consent where consent is the reason, and recording it
Telling patients how their information will be used
Answering patients who ask to see or correct their information
Reporting serious data incidents to the regulator when the law requires it

3. People's Rights Under the Law

Data protection law gives people rights over their personal information. These include:

Right to Access

People can ask for a copy of the personal information held about them.

Right to Correction

People can ask for information that is wrong or incomplete to be corrected.

Right to Erasure

In some cases, people can ask for their information to be deleted, subject to other legal duties such as keeping health records.

Right to Object and Withdraw Consent

People can object to some uses of their information, and withdraw consent they have given.

4. Tools in MyDentalPractice That Help

MyDentalPractice has not been audited or certified against these laws, and using it does not by itself make a clinic compliant. It does give your team tools that help you look after patient information:

Individual sign-ins and roles: every staff member has their own sign-in, and what each person can see and do is set by their role.
Two-step sign-in: available for staff accounts, and the Clinic app also supports passkey sign-in.
Sign-in protection: repeated failed sign-in attempts temporarily lock the account.
Consent forms: documents and consent forms are kept in the patient file.
Activity records: changes to records such as patient details, charts and visits are logged with who made them and when.
Patient app: patients can see their appointments, treatment plans, invoices, prescriptions and documents from your clinic.
Automatic backups: clinic data is backed up automatically.
Waiting-room Kiosk: the Kiosk app shows no patient records.

5. Regulators

People who are unhappy with how their personal information has been handled can complain to the regulator:

Nigeria: Nigeria Data Protection Commission (NDPC)
Ghana: Data Protection Commission of Ghana

6. Questions

If you have questions about data protection or how MyDentalPractice handles your clinic's information, we are happy to talk them through with you.

Contact Us

General questions

[email protected]

Clinics already using MyDentalPractice