Does a simple contact form need a privacy notice?

Yes. A form that stores a name, phone number, or email is personal data. The notice should say what you do with the message and how long you keep it.

Is this legal advice?

It is a build checklist. Registration and sending data outside Ghana should be checked with the Data Protection Commission or a lawyer in Ghana.

Compliance guide

Ghana Data Protection Act for websites

If your website collects a name, a phone number, an email, or a payment from someone in Ghana, the Data Protection Act, 2012 (Act 843) applies. The Data Protection Commission handles registration and complaints. This page is a build checklist. It is not legal advice.

A closed folder and a key on a dark office desk

Updated September 2026 · OceanCyber, Accra

Talk to the team

Write the notice from the site you actually have

A privacy page copied from a US site fails when it talks about data you do not collect, or skips the MoMo number and delivery address you do collect.

For a normal company site or shop, the list is short.

List every form: contact, checkout, newsletter. Say which fields you keep and for how long.
If you use Paystack, say so, and say they also hold the payment record.
Name the company that hosts the site and the analytics tool. If you use our hosting, say who can open the admin.
Give admin access only to the people who run the site, and turn on HTTPS before the form goes live.
Write one page for a breach: who you call, how you tell customers, and where the backup is.
Ask the Data Protection Commission, or a lawyer in Ghana, whether you must register. Do that before a big client asks for the certificate.

Name the other companies that see the data

Hosting, email, Paystack, analytics, and any SMS service see personal data for you. Write down who they are. On a GHS 30,000 build we include that list in the work. A smaller site still needs the notice and the limited admin access on day one.

Common questions

Does a simple contact form need a privacy notice?: Yes. A form that stores a name, phone number, or email is personal data. The notice should say what you do with the message and how long you keep it.
Is this legal advice?: It is a build checklist. Registration and sending data outside Ghana should be checked with the Data Protection Commission or a lawyer in Ghana.

Match the notice to the forms

We list the forms, payments, and host before launch, so the privacy page matches the site.