Data Localization Undermines Privacy Protections

This provision authorizes the NCA to impose "data localisation obligations" on OTT service providers (subsection 5a), requiring user data to be stored within Ghana. This contradicts international privacy best practices: data localization prevents use of privacy-compliant international infrastructure (like GDPR-certified EU data centers), concentrates data in a single jurisdiction creating security risks, and conflicts with principles allowing cross-border data transfers with adequate safeguards. Combined with mandatory registration for all OTT providers and vague licensing criteria, this creates a framework for government oversight of privacy-sensitive communication platforms without clear privacy safeguards or limits on regulatory authority.