Accra, Ghana, October 23, 2026: You need money fast. You install a loan app and reach a screen asking to read your contacts. You hesitate, then you tap Allow because the loan matters more.
That tap can reach far beyond your phone. The Cyber Security Authority (CSA) has warned that some digital lending apps used borrowers' data to threaten and shame them, and to contact people who never took a loan.
What the CSA found
In an advisory of 5 January 2023, the CSA reported cyberbullying by owners of digital lending apps. When borrowers defaulted, the owners threatened to publish their identities as wanted persons or fraudsters on social media and to send the claim to their contacts. In some cases they followed through. Some people received threats although they had taken no loan.
The CSA said victims had usually granted permissions at installation, giving the apps access to their name, phone number, Ghana Card number, contacts and photos. It said the Bank of Ghana had stated, in notice BG/GOV/SEC/2022/10, that it had not licensed any company to provide digital lending of that kind. The CSA also said the apps had not met the Data Protection Commission's compliance obligations, so their use of data violated the Data Protection Act, 2012 (Act 843). That is the CSA's finding, and it applied to the apps it named in 2023, not to every lender.
What Act 843 says
The Act took effect in October 2012. It sets out principles in section 17, and several sections matter to a borrower.
•Section 19, minimality. A person may process personal data only if the purpose is necessary, relevant and not excessive. A lender must justify why it needs each item. Your friends' numbers are hard to justify for a loan decision.
•Section 20, consent, justification and objection. Processing needs your consent unless the Act allows another ground, such as necessity for a contract or a legal duty. You may object to processing, and the controller must stop unless an exception applies.
• Sections 22 and 23, specific purpose and awareness. Data must be collected for a specific, lawful purpose, and you must be told what that purpose is.
• Section 25, further use. Later use must be compatible with the original purpose. Collecting data to assess a loan does not permit using it to embarrass you.
Under the Act, a person who suffers damage because a controller breaks it can claim compensation on proof of damage. The Act also requires data controllers to register with the Commission. In October 2026 the Commission flagged six companies for processing data without valid registration, and its director said section 53 prohibits processing without registering.
Can you refuse?
You can refuse a permission on your phone at any time. Whether the lender must still give you the loan depends on the contract and on whether the data is really needed. The Act does not say every lender must lend without contacts. It says collection must be necessary, relevant and not excessive.
Ask the lender four questions in writing: why it needs the data, how it will use it, who will receive it and how long it will keep it. A lender that cannot answer has a problem under sections 19, 22 and 23.
Switching a permission off stops future access through that permission. It does not erase data already collected, and it does not cancel a debt.
Graphic: before a loan app gets your contacts. Gender Lens Africa.
Your contacts are other people's data
Your address book holds names and numbers of relatives, colleagues and clients. None of them agreed to share their details with a lender. When an app reads your contacts, it takes data from people who have no part in your loan.
That is why contact permissions deserve more scrutiny than a camera or location permission. The risk falls on the people you know.
If an app threatens you
A debt does not give a lender the right to publish your photo, threaten your family or message your contacts. Keep the evidence first: screenshots of messages, phone numbers, payment demands and the app's name. Do not delete anything before you report.
Report threats and extortion to the CSA on 292 (call or text), on WhatsApp at 0501603111 or at report@csa.gov.gh. Make a data complaint to the Data Protection Commission through the Commission's website, which has a complaints option. Its contact page lists +233 25 630 1533 and info@dataprotection.org.gh. Ask the Bank of Ghana whether a lender is licensed before you install the app. Our explainer on online abuse covers threats to share intimate images.
A new law may be coming
A Data Protection Bill, 2025 would repeal and replace Act 843, with higher penalties and wider individual rights. Check its status before you cite section numbers from the 2012 Act in a complaint.
Sources and further reading
Cyber Security Authority: advisory on cyberbullying by digital lending apps,
Data Protection Act, 2012 (Act 843), arrangement of sections.
Data Protection Commission, Ghana: rights, complaints and contact details.
Data protection factsheet on Ghana.
