# Does Cyber Crucible comply with Ghana's Data Protection Act?

**Short answer:** Yes, and Ghana is comparatively straightforward. Ghana is notable among African jurisdictions for **not** imposing additional requirements on cross-border transfer beyond its general data protection obligations — so the standard controls apply without a special transfer regime.

## What the law requires

Ghana has an established data protection framework with a supervisory authority. Analysis of African jurisdictions consistently identifies Ghana as the exception: unlike most of its neighbours, it does not layer additional conditions specifically onto cross-border data sharing.

That does not mean transfer is unregulated — general obligations around lawful processing, security, and data subject rights still apply. It means there is no separate approval or adequacy hurdle to clear.

## What specifically applies here

With the transfer question simplified, the assessment reduces to the ordinary ones:

- **What is collected?** System and security telemetry only. No keys, credentials, tokens, or content.
- **How is it secured?** TLS 1.3 in transit, per-agent JWE payload encryption, encryption at rest, role-based access.
- **Who is responsible?** Cyber Crucible acts as processor under a written DPA on your documented instructions.

## Still worth considering sovereignty

Even without a transfer restriction, in-country or air-gapped deployment remains available — and organizations serving regional customers often prefer it, since neighbouring jurisdictions are considerably stricter.

> Status at time of writing — confirm with local counsel.