What personal data looks like in Ghana

Most tools that find personal information were built and tested on American and European data. They know a US Social Security number and a UK postcode on sight, and little about the Ghana Card, GhanaPost GPS addresses or the way a phone number in Ghana doubles as a bank account. Our work on Veil, Dekka's engine for protecting personal information before it leaves Ghana, began with a plain question about what personal data actually looks like here.

To answer it we traced every Ghanaian identifier we could find to the body that issues it, read the terms of every public Ghanaian-language dataset we could find, studied how people write their names, addresses and phone numbers in English, Twi, Ewe, Ga, Pidgin and the mixtures between them, and measured how widely used tools cope. This report shares what we learned. It leaves out how Veil itself detects personal data, which is ours to keep.

In brief

1. One Ghana Card PIN now links identity, tax, pension, health insurance, phone lines and bank accounts, so a leaked PIN exposes far more than an ID card.
2. Many Ghanaian identifiers describe the people who hold them, recording nationality, region of birth, the school where someone sat their exams, or a five-metre square of ground.
3. A phone number is often also a wallet, and since numbers can move between networks, its prefix no longer tells you which operator holds the money.
4. Names say more here than in most places. An Akan day name gives away a person's sex and the day of the week they were born.
5. Several identifiers have no published format at all, and the formats that are published are scattered across portals, filings and printed cards.
6. Ghanaian languages are thin in open data, no labelled collection of Ghanaian personal information existed in any language, and some popular datasets carry licences that don't hold up.
7. In our tests, two widely used open-source tools together found 1 of 462 Ghana Card PINs, and in Twi and Ewe news most of the words they marked as names weren't names.
8. Ghana's data protection law has no detailed rules yet for sending data abroad, while more Ghanaian data than ever leaves the country inside prompts to AI models.

The identifiers Ghana issues

Ghana's identifiers are defined by more than a dozen institutions, and their formats live in results portals, USSD instructions, filings to international bodies and the cards themselves rather than in one place. We collected what each issuer says, labelled how strong the evidence is, and noted what each identifier reveals about the person who holds it. Where an issuer publishes nothing, we say so and don't guess, because an invented format misses real numbers and flags ordinary ones.

Three things stand out. The Ghana Card has absorbed the tax and pension numbers, so the most sensitive identifier in the country is also the most widely used. Many identifiers are short runs of digits, such as the ten-digit voter ID and the eight-digit NHIS number, which look exactly like phone numbers, dates and invoice references, so their shape alone says little about what they are. And identifiers that matter in daily life, such as the driver's licence and the birth certificate, have no public format at all.

Even published formats carry surprises. The Ghana Revenue Authority's description of the Ghana Card PIN, given in a filing to the OECD, says its final character can be a digit or a letter and is checked by an algorithm used internally when the PIN is created. Nobody outside the NIA can confirm that a PIN is genuine, only that it is well formed, and any tool that claims more is overstating what it knows. The NIA's own FAQ, meanwhile, writes a Nigerian resident's prefix as NRG where the international code is NGA, so even the issuer's examples don't always follow the standard.

One number, many records

Ghana has spent the last five years making the Ghana Card PIN the key to almost everything. It became the taxpayer number for individuals on 1 April 2021 and the social security number in June 2021. Every SIM card in the country had to be re-registered against a Ghana Card between October 2021 and September 2022, and from 1 July 2022 the Bank of Ghana made the card the only identification accepted for transactions at the banks, payment providers, mobile money issuers and forex bureaux it regulates. New health insurance members enrol with it too.

The policy has real benefits, since one verified identity makes fraud harder and services easier to reach. It also concentrates risk. A PIN that leaks from a support ticket or a pasted spreadsheet now points to a person's tax affairs, pension, phone line and bank accounts at once, and it can't be changed the way a password can.

What it meansTreat the Ghana Card PIN as the most sensitive identifier your organisation holds, wherever it appears and whatever it is called. A PIN labelled “TIN” or “SSNIT number” is still a Ghana Card PIN.

Identifiers that describe people

In many countries an identifier is an arbitrary number. Several of Ghana's encode facts about the person, so even a partly visible identifier can leak something.

• A Ghana Card PIN begins with the holder's nationality at first registration, so a resident's card can show another country's code.
• A legacy SSNIT number, still found in older payroll and pension records, begins with a letter that SSNIT says records the member's region of birth.
• A WAEC index number begins with the seven-digit number of the centre where the candidate sat the exam, which is usually their school.
• A vehicle plate shows the region it was registered in and, on most plates, the year.
• A GhanaPost GPS address resolves to a square five metres across, which is precise enough to pick out a single house.
• A landline's area code places it in a region.

Data protection guidance often treats masking part of a number as enough. For these identifiers, the part left visible may be the part that identifies, so the whole value should be protected.

Phone numbers and mobile money

Every Ghanaian phone number has had nine digits after the trunk 0 since May 2010. People write the same number as 024 123 4567 at home and as +233 24 123 4567, 00233 24 123 4567 or 233241234567 from abroad, often with a stray (0) left in, and spacing varies from one writer to the next. Landlines begin with 3 and carry a regional area code.

Mobile money changes what a phone number is. A wallet is identified by the subscriber's number, so the same digits are contact details in “call me on” and a payment account in “send it to my momo”. Ghana also has number portability, so a number that began on one network may now be on another, and a prefix no longer proves which operator holds the wallet. Merchants add another layer, with short merchant IDs keyed in after a USSD code, many of which belong to sole traders rather than companies.

Not every number in a message belongs to a person. Businesses print their switchboard and customer service numbers everywhere, and a sentence such as “call the bank on 0302 …” contains a phone number that isn't personal at all. A tool that protects every number it sees will flood its users with false alarms, and one that protects only mobile numbers will miss the home landline.

What it meansPhone numbers in Ghana carry financial risk. Protect them with the context they appear in, and expect the same number to mean different things in different sentences.

Addresses, written two ways

Since 2017 every five-metre square of Ghana has had a GhanaPost GPS digital address. The first letter names one of sixteen regions, the next one or two characters name the district, and an area number and a four-digit address follow. Ghana Post's own example, AK-039-5028, is the Kumasi Main Post Office.

The district part is less regular than it looks. Ghana Post's published list of district codes mixes two- and three-character codes, and some use a digit, as Adansi North's A2 does, so a format written for two letters misses real addresses. Districts are also created and renamed as local government changes, and the list changes with them. People write the separators however they like, with hyphens, spaces or none at all. And a valid digital address can belong to a shop, a church or a post office, so finding one doesn't mean you have found someone's home.

Most people, most of the time, give directions instead. Addresses in messages, delivery notes and support chats are sentences built from landmarks, such as a church, a filling station, a school, a market or the colour of a gate, in any mix of English and a Ghanaian language.

Chale, I dey house. Find me behind the Presby church at Adenta Housing Down, the house with the green gate.A synthetic example of how an address is often written

Nothing in that sentence looks like an address to a tool that expects a street number and a postcode, yet it locates a person to a single house. Protecting it means recognising the whole description, from the first landmark to the gate, because redacting only the church leaves the rest pointing at the same front door.

What a name gives away

Ghanaian names follow conventions that make them richer, and more revealing, than the names most privacy tools were trained on.

Akan children are traditionally given a name for the day of the week they were born, and the name differs for boys and girls, so Kofi is a boy born on a Friday and Ama a girl born on a Saturday. A day name alone therefore discloses sex and day of birth, and with a birth year from elsewhere in a record it narrows a birthday to about fifty days. Ewe has its own day names, such as Kodzo, Abla and Yawo, and other traditions use names for birth order, for twins and for the circumstances of a birth.

Several other features make names hard for tools built elsewhere.

• Spellings vary by region and by family, as with Kwesi and Kwasi or Adjoa and Adwoa, and people shorten names freely, so Akosua becomes Akos and Kwabena becomes Kobby.
• Titles and honorifics come before names and some are names themselves. Nana is both a title for a chief or elder and an ordinary given name, and Togbe, Naa, Opanyin, Maame, Auntie and Sister appear constantly in everyday text.
• Many names are also ordinary words, such as Adom (grace), Nhyira (blessing) and Ohemaa (queen), which is why tools that find names by their shape mark so many ordinary Twi words as names.
• English and Christian names sit beside local ones, so the same person may be Kwame in one message, Emmanuel in another and Mr Mensah in a third.
• Folklore characters and public figures share names with private people. Kweku Ananse is a character, and a minister named in the news is speaking in a public role.

Open data reflects only part of this. The largest open list of names of people with Ghanaian citizenship, drawn from public records of notable people, leans heavily towards Akan names and towards men, and we found no open frequency list of names for the Ewe, Ga-Dangme, Mole-Dagbani or other groups at all.

The languages people write in

Ghana has dozens of languages, and English is only one of the ones people type in. Twi, Ewe, Ga and Fante are all common online, Ghanaian Pidgin is everywhere in informal writing, and people move between them and English within a single message.

Me momo nɔma ne 024 123 4567.“My momo number is 024 123 4567”, a synthetic example in Twi

We mapped the best public resource of each kind for each language, and judged each by its terms of use, since a dataset that can't be used commercially can't become part of a product. The picture is uneven. Twi is relatively well served, and speech projects at Ghanaian universities have done more for the northern languages than written text has. Labelled names and places exist only in Twi and Ewe, and only under non-commercial terms. Sisaala has no public resource of any kind that we could find, and Ghanaian Pidgin, which most young Ghanaians write daily, has almost nothing beyond a set of tweets.

The models privacy tools are built on reflect this. The widely used multilingual language models list none of Twi, Ewe or Ga among the languages they were trained on, so a tool built on them meets these languages for the first time when it reads a Ghanaian customer's message.

What it meansPrivacy protection for Ghana has to be built for its languages and tested in each one. A single overall score hides exactly the weaknesses that matter here.

The state of open data

Before this work, no labelled collection of Ghanaian personal information existed in any language, so nobody could measure how well a privacy tool protected Ghanaian data. Dekka built its own from synthetic records, and every claim we make about Veil can now be checked against Ghanaian text. Along the way we found problems in the open data ecosystem that anyone building for Ghana should know about.

Licences that don't hold up

JW300, once the largest collection of parallel text in Twi, Ewe and Ga, was withdrawn from the OPUS repository after a legal review found it breached the terms of the website it was collected from, and a 2026 audit of licences in African NLP documents several more corpora whose stated licences don't survive scrutiny. We found the same pattern repeatedly. Copies of non-commercial datasets are re-uploaded with permissive labels, a single dataset can carry one licence in its paper and another on its download page, open-licensed packaging can wrap text that remains government copyright, and many datasets declare no licence at all, which grants no permission to use them.

What is missing

• Any labelled collection of Ghanaian personal information, in any language.
• Labelled names and places in Ga, Fante, Dangme, the northern languages or Ghanaian Pidgin.
• Sizeable Ghanaian Pidgin text, and real Ghanaian chat or customer support text under usable terms.
• Vocabulary for how people mention identifiers in Twi, Ga or Ewe, such as how someone asks for a Ghana Card number in conversation.
• Open name frequency lists for anyone other than the Akan.

What it meansRead the licence at the source, follow the stricter terms when two disagree, and assume a dataset with no licence can't be used. Much of what is labelled open isn't.

How general-purpose tools cope

We measured two widely used open-source tools for finding personal information against our synthetic Ghanaian test set. One combines patterns with an English language model, and the other is a neural model that finds whatever kinds of detail it is asked for. We also ran both on public Twi and Ewe news text in which linguists have marked names and places. Neither tool was designed for Ghana, so the results describe a gap rather than a failing of either project.

1 of 462

Ghana Card PINs in our test set found by the two tools together

1 of 266

GhanaPost GPS addresses found by the two tools together

None

of the hospital patient numbers or school student numbers found by either tool

Every

decoy record, made of details that only look personal, had something flagged by both tools

6 to 39

in every hundred words the tools marked as names in Twi and Ewe news were actually names

Both tools did well on what they were built for. They found most phone numbers, email addresses and IP addresses, and the pattern-based tool found English-language names reliably. The gaps were in everything specific to Ghana. Ghana Card PINs and GhanaPost GPS addresses went almost entirely unseen, and neither tool found a single hospital patient number or school student number, whose formats change from one institution to the next.

The neural tool sometimes found part of an address written as directions but never marked a whole one correctly. That matters more than it sounds, because a redaction that removes “Adenta” and leaves “behind the Presby church, the house with the green gate” still gives the house away. In Twi and Ewe news both tools found most real names but marked many ordinary words as names along with them, and both flagged public business numbers and plates on public vehicles as if they were personal.

Our test set is synthetic and built from templates, so every tool would score lower on real messages. Its value is in showing which kinds of detail each tool finds and misses, which is the question an organisation choosing a tool needs answered.

Data leaving Ghana, and the law

More Ghanaian personal data leaves the country than ever. As far as we can find, none of the largest cloud providers runs a region in Ghana, and the frontier AI models most organisations use are served from data centres abroad. The newest route is the prompt. A support agent pastes a customer's complaint into an assistant, complete with the customer's Ghana Card PIN and momo number, or a team uploads a spreadsheet of applicants to have it summarised, and the personal data travels with the request.

Ghana's Data Protection Act, 2012 (Act 843) sets out eight principles for processing personal data in section 17, from accountability and purpose specification to security safeguards and the data subject's participation. It requires consent, with narrow exceptions, to process special personal data such as health, religion and political opinion, and it requires data controllers to register with the Data Protection Commission. It has no detailed rules for transferring data abroad, and lawyers commonly advise notifying the Commission before a transfer.

A Data Protection Bill, whose public consultation closed on 31 October 2025, would replace Act 843 and set conditions for transfers abroad, including safeguards before data leaves the country. When we finished this report we couldn't confirm that it had become law, so organisations should check its status with their advisers. Sector rules apply too, such as the Bank of Ghana's requirement that regulated institutions identify customers with the Ghana Card.

None of this is legal advice. Tools like Veil reduce what personal information leaves, but they don't establish compliance on their own, and no detector catches everything.

How we research

The standards behind this report apply to everything Dekka publishes.

• Every identifier format comes from the body that issues it, or from an international body it reports to such as the ITU, the Universal Postal Union, ICAO or the OECD. Weaker evidence is labelled as weaker, and a format nobody publishes is never invented.
• We read the terms of anything we learn from on the publisher's own pages, and follow the stricter reading when two official sources disagree.
• We never collect real people's identifiers to study them. Every example in this report is synthetic or an issuer's own, and public text that contains real people's details is used only to measure, never to publish.
• Our test records cover banking, mobile money, health, education, government, employment, customer support, everyday messages and prompts to AI assistants, in English, Twi, Ghanaian Pidgin and mixtures of them. They include decoys, such as business phone numbers, public vehicles and dates, which look personal and aren't, because a tool that flags everything is as unusable as one that flags nothing.
• Written guidelines decide exactly where each detail starts and ends, so that “Nana Yaw Mensah” is one name and a set of directions is one address. We score both whether a tool touched a detail and whether it covered all of it, because partial redaction leaves pieces visible.
• We check whether a tool's confidence means anything, by measuring how often its findings are right at each confidence level.
• Results are reported separately for English and each Ghanaian language, never blended into one number, and accuracy and speed figures are published only with the data and hardware they were measured on.

What organisations should do

Whether or not you use Veil, these steps reduce how much Ghanaian personal data you expose.

• List the Ghanaian identifiers your systems hold, including those inside free text such as support tickets, chat logs, CVs and scanned forms, where most of them hide.
• Treat the Ghana Card PIN as your most sensitive identifier, under whatever name it appears, and protect the whole value rather than masking part of it.
• Treat phone numbers that appear with payment words as financial data.
• Decide for each destination what may leave and in what form, whether removed, masked or replaced with a token you can reverse later, and enforce it before data reaches an AI model abroad.
• Test any privacy tool on your own text, in the languages your customers actually write, before you rely on it.
• Keep a record of what was protected, without keeping the values themselves.
• Register with the Data Protection Commission and take advice on transfers abroad, especially while the law is changing.

Questions to ask any privacy tool

• Does it recognise the Ghana Card PIN, GhanaPost GPS addresses and Ghanaian phone numbers in all the ways people write them?
• Does it know that a Ghana Card PIN can be checked for form but not for authenticity, and does it say so?
• Can it tell a person's number from a business's, and a home address from a shop's?
• Has it been measured on Twi, Ewe, Ga, Pidgin and mixed text, with results reported for each?
• Does it find addresses written as directions, and cover the whole description?
• Where does it run, and does the data it inspects leave the country?

Those are the decisions Veil and the AI Gateway are built to make routine.

What would help

Much of what is missing can only come from the institutions and communities that hold it.

• Written format specifications from the Passport Office, the DVLA, the Births and Deaths Registry and the Ghana Immigration Service, and SSNIT's full description of legacy numbers, would let every privacy tool protect these identifiers properly.
• Dataset publishers can help by stating one licence in every place they publish, and keeping it with every copy.
• Organisations willing to share a small, consented and reviewed set of real Ghanaian documents, under an agreement that keeps it private, would let tools be measured on real text rather than synthetic text.
• Speakers of Ghanaian languages can help us collect how people really talk about phone numbers, Ghana Cards and addresses in Twi, Ewe, Ga and beyond.

If you can help with any of these, write to us at hello@dekka.cloud.