Security and Safety Compliance in Ghana: The Laws, Regulations and Standards That Apply to Your Premises

Key takeaways

• Security and safety obligations for Ghanaian premises come from several statutes at once: the Factories, Offices and Shops Act, 1970 (Act 328), the Ghana National Fire Service Act, 1997 (Act 537) and the Fire Precautions (Premises) Regulations, 2003 (LI 1724), the Labour Act, 2003 (Act 651), the Data Protection Act, 2012 (Act 843), and the Police Service (Private Security Organisations) Regulations, 1992 (LI 1571), among others.
• No single regulator inspects for all of them. The GNFS, the Department of Factories Inspectorate, the Data Protection Commission, the Ministry of the Interior, the Bank of Ghana and the local assembly each look at a different slice.
• International standards such as ISO 31000, ISO 45001 and the ASIS International guidelines are not law in Ghana, but they are what insurers, head offices and courts use to judge whether what you did was reasonable.
• The practical answer is one risk register that maps every obligation to a control, an owner and an evidence record.

Most organisations in Ghana discover their compliance obligations one at a time, usually when a regulator, an insurer or a head office asks for something. This article sets them out together, in plain language, so that facilities, security, HR and compliance teams can see the whole picture. It is a map, not legal advice; section-level requirements should be confirmed with counsel for your specific premises and sector. Statutes are named by title and year throughout.

Part 1: Ghanaian statutes and regulations

Factories, Offices and Shops Act, 1970 (Act 328)

Act 328 is the foundation of workplace safety law for most commercial premises. It requires the registration of factories, sets duties on occupiers for safe means of access and egress, cleanliness, lighting, ventilation, guarding of machinery, safe storage and fire precautions, and provides for inspection by the Department of Factories Inspectorate. The Act predates modern risk-based safety management, so its requirements are prescriptive: the inspector checks for specific conditions rather than for a management system. Occupiers of factories, warehouses, workshops and larger offices and shops should expect inspection, and should keep the registration certificate and inspection correspondence on file.

Ghana National Fire Service Act, 1997 (Act 537) and the Fire Precautions (Premises) Regulations, 2003 (LI 1724)

Act 537 establishes the GNFS and gives it responsibility for fire prevention, inspection and investigation. LI 1724 is the instrument occupiers meet most directly: it designates the classes of premises that must hold a fire certificate, sets out the precautions the GNFS assesses, and makes operating a designated premises without a certificate an offence. The certificate is valid for 12 months and renewed after re-inspection. Our step-by-step guide to getting a fire certificate in Ghana covers the process; the fire certificate page summarises the requirements.

Labour Act, 2003 (Act 651)

The Labour Act places a general duty on employers to ensure that every worker employed works under satisfactory, safe and healthy conditions, and on workers to use the safety appliances provided. It also requires the reporting of occupational accidents and diseases. Where Act 328 is prescriptive and premises-focused, Act 651’s duty is general and employer-focused, which is why it is the provision most often cited after an injury at a site that is not a registered factory.

Workmen’s Compensation Act, 1987 (PNDCL 187)

PNDCL 187 governs compensation for workers injured in the course of employment. Its relevance to security and safety programmes is evidential: an employer’s records of risk assessment, training, supervision and incident reporting are what determine whether an injury was foreseeable and whether reasonable precautions were taken.

Data Protection Act, 2012 (Act 843)

Security systems process personal data: CCTV footage of identifiable people, access-control logs, visitor registers, guard patrol records with names, and investigation files. Act 843 requires that this processing be lawful, proportionate and secured, that data subjects be informed (hence CCTV signage), that retention be limited to what is necessary, and that organisations processing personal data register with the Data Protection Commission. Investigations and pre-employment vetting carry particular obligations because they process data about individuals who may not know it is being collected.

Police Service (Private Security Organisations) Regulations, 1992 (LI 1571)

Private security organisations in Ghana, the guard companies, are licensed by the Ministry of the Interior under LI 1571 and operate under Police supervision. For the organisations that hire them, the practical obligations are to use a licensed provider, to understand that guards are not police and have no special powers of arrest or search beyond those of any citizen, and to manage the contract so that the guard force’s performance can be evidenced. Our guide to vetting and managing a private security company in Ghana goes into the detail.

Ghana Building Code (2018)

The Ghana Building Code, published as a national standard in 2018, sets out requirements for building design and construction including means of escape, fire resistance, fire detection and suppression, and accessibility. It applies through the development permit process of the local assembly and is the reference the GNFS and building inspectors use for new construction and major alteration. For occupiers of existing buildings it is the benchmark against which “should this building have had this?” is answered.

Sector directives

Certain sectors carry additional requirements. Banks and other financial institutions are subject to Bank of Ghana directives on the security of branches, ATMs and cash operations, and to the Bank’s expectations on business continuity. Insurers licensed under the Insurance Act, 2021 (Act 1061) impose conditions on policyholders, typically around cash handling, fire precautions and intruder protection, that become enforceable at claim time. Petroleum retail and storage operate under National Petroleum Authority licensing conditions that incorporate fire and safety requirements. Diplomatic missions apply their sending state’s security standards on top of Ghanaian law.

Local assembly permits

Metropolitan, municipal and district assemblies issue business operating permits and, increasingly, require evidence of a current fire certificate as a condition. The assembly is often the first body to notice a lapse, because the permit is renewed annually.

Part 2: International standards

None of the following is law in Ghana. All of them are what a head office, an insurer, an adjuster or a court will use to decide whether your security and safety arrangements were reasonable.

• ISO 31000 (Risk management) is the framework most organisations use to make security risk decisions consistent and defensible: establish context, identify, analyse, evaluate, treat, monitor. A security programme anchored to ISO 31000 can explain why it did what it did.
• ISO 45001 (Occupational health and safety management systems) is the management-system standard for workplace safety. Certification is not required in Ghana, but the structure, with hazard identification, legal register, controls, competence, incident investigation and review, is what regulators and insurers increasingly expect to see even without the certificate.
• ISO 22301 (Business continuity) covers what happens after the incident the security programme failed to prevent. Relevant to banks, insurers, hospitals and utilities in particular.
• ASIS International standards and guidelines are the body of practice for physical security: enterprise security risk management, physical asset protection, security officer selection and training, investigations. ASIS also administers the CPP, PSP and PCI board certifications that evidence individual competence.
• NFPA codes are the reference for fire engineering where Ghanaian regulations are silent on detail: NFPA 72 for fire alarm systems, NFPA 101 for life safety, and NFPA 921 and 1033 for fire investigation methodology and investigator qualifications.

For how the ISO and ASIS frameworks fit together in practice, see Aligning physical security with ISO 31000 and ASIS standards.

Part 3: Who enforces what

Obligation	Primary authority	How it usually surfaces
Fire certificate, fire precautions	Ghana National Fire Service	Annual inspection, assembly permit, insurer, after a fire
Factory registration, workplace conditions	Department of Factories Inspectorate	Inspection, after an accident
General duty of safe work, accident reporting	Labour Department	After an injury, labour dispute
Personal data in CCTV, access logs, vetting	Data Protection Commission	Complaint, registration audit, after a breach
Guard company licensing	Ministry of the Interior / Police	Licence check, incident involving guards
Building design, means of escape	Local assembly, GNFS	Development permit, major alteration
Branch and cash security	Bank of Ghana	Supervisory examination, after an incident
Policy conditions	Insurer	Renewal survey, claim

The point of the table is that no single inspection covers you. An organisation can hold a current fire certificate and still be in breach of Act 328, Act 843 and its own insurance conditions.

Part 4: Evidencing compliance in one register

The workable answer for most organisations is a single security and safety risk register that does four things for every obligation: names the requirement, maps it to the control that meets it, names the person who owns that control, and points to the evidence that the control is operating. The evidence is the part that fails most often. A fire drill that was held but not recorded, an extinguisher serviced but not tagged, a guard patrol done but not logged, and a CCTV retention policy that exists in someone’s head are all controls that cannot be proved when the inspector, adjuster or lawyer asks.

A baseline assessment builds this register from the premises up: walking the site, reading the records, testing the controls and matching what exists against what each obligation expects. From there the register becomes a living document reviewed on a cycle, with the annual fire certificate renewal, factory inspection and insurance renewal as fixed points. We wrote about the case for one register rather than parallel safety and security programmes in Safety and security on one risk register.

A ten-point self-check

1. Is the fire certificate current, displayed, and does it describe the building as it is now?
2. If the premises is a factory or large workplace, is it registered and when was it last inspected?
3. Is there a named person responsible for fire safety and for workplace safety, and do they know it?
4. Are fire drills, extinguisher servicing, alarm tests and emergency lighting tests recorded?
5. Is CCTV signage in place, is there a written retention period, and is access to footage logged?
6. Is the organisation registered with the Data Protection Commission where required?
7. Is the guard contractor licensed, and does the contract set measurable performance standards?
8. Have insurance policy conditions on cash, fire and intruder protection been read and mapped to controls?
9. Are sector directives, such as those from the Bank of Ghana, reflected in site standards?
10. Is there one register that holds all of the above, with owners and evidence?

If you cannot answer most of these from records rather than memory, a structured assessment is the fastest route to a defensible position. Request an assessment and we will scope it within one business day, covering security and safety obligations in a single visit.