Effective Date: July 2026Version 2.0Act 843 Compliant
1. Introduction and Scope
National Investment Bank PLC ("NIB", "we", "us", or "our") respects your privacy and is committed to protecting your personal data in accordance with Ghana's Data Protection Act, 2012 (Act 843). We operate as a registered Data Controller with the Data Protection Commission of Ghana.
This General Privacy Policy Statement ("Policy") sets out the basis on which any personal data we collect from you, that you provide to us, or that is otherwise made available to us will be processed. It does not form part of any contract between the Bank and any customer or other person and shall not be construed as creating any contractual or legal rights beyond those provided under applicable law. This Policy applies to all individuals ("Data Subjects") whose personal data is processed by NIB, including customers, account holders, prospective clients, employees, vendors, visitors to our website (www.nib.com.gh), users of our digital platforms, and visitors to our physical premises.
By interacting with NIB, you acknowledge that you have read and understood the practices described in this Policy.
2. Our Data Protection Principles
In compliance with Section 17 of Act 843, NIB is committed to the following core principles when processing your personal data:
Accountability: We take full responsibility for ensuring compliance with privacy laws.
Lawfulness of Processing: We process data in a lawful, reasonable manner without infringing your privacy rights.
Specification of Purpose: We collect data only for explicitly defined, lawful purposes related to our banking operations.
Compatibility of Further Processing: We ensure any secondary use of data aligns with the original collection purpose.
Quality of Information: We take reasonable steps to ensure your data is complete, accurate, up-to-date and not misleading.
Openness: We maintain transparency about our data practices and provide clear notice of collection.
Data Security Safeguards: We implement robust technical and organisational measures to protect your data.
Data Subject Participation: We respect and facilitate your right to access, correct, and control your personal information.
3. The Data We Collect and the Principle of Minimality
In accordance with the principle of minimality (Section 19 of Act 843), NIB collects only the personal data that is necessary, relevant, and not excessive for our identified purposes. The categories we process include:
Identity Data: Full name, maiden name, date of birth, place of birth, gender, marital status, nationality, national identification number (e.g., Ghana Card), passport number, and photographic images.
Contact Data: Residential address, postal address, email address, and telephone numbers.
Financial and Banking Data: Bank account details, debit/credit card numbers, transaction history, income details, and credit history.
Technical and Digital Data: Internet Protocol (IP) address, MAC address, login data, browser type and version, time zone setting, operating system, and information regarding your interaction with our digital platforms.
Biometric Data: Fingerprints or facial recognition data used for authentication purposes.
Security Data: CCTV footage from our premises and recordings of telephone conversations with our customer service centre. The CCTV surveillance is used for security, crime prevention, fraud detection and the protection of persons and property.
4. Processing of Special Personal Data
Under Section 37 of Act 843, certain information is classified as 'Special Personal Data', including information relating to religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life, or criminal behaviour.
NIB generally prohibits the processing of special personal data. We will only process such data where strictly necessary and permitted by law, such as:
With your explicit consent
Where necessary for the establishment, exercise, or defence of legal rights
For compliance with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations (e.g., politically exposed persons screening)
5. How We Collect Your Data
In compliance with Section 21 of Act 843, NIB's default position is to collect personal data directly from you. We do this through:
Direct Interactions: Information you provide when opening an account, applying for a loan, or communicating with us.
Automated Technologies: Information automatically collected when you interact with our digital platforms.
We may collect data indirectly from third parties or public sources only where permitted by law, such as:
Information received from credit reference bureaus for credit assessment.
Verification data from government registries (e.g., National Identification Authority).
Information from your employer regarding salary processing.
6. Lawful Basis for Processing
NIB will not process your personal data without your prior consent unless a statutory justification under Section 20 of Act 843 applies. We rely on the following lawful bases:
Performance of a Contract: Where processing is necessary for the execution of a contract to which you are a party.
Legal and Regulatory Obligations: Where processing is necessary for compliance with statutory duties, including banking regulations, AML/KYC requirements, and tax laws.
Legitimate Interests: Where processing is necessary to pursue the legitimate interests of NIB or a third party, provided these do not override your privacy rights (e.g., fraud prevention, network security).
Consent: Where you have provided explicit consent for specific processing activities, such as direct marketing. You may withdraw this consent at any time.
7. Information Sharing and Disclosure
We do not sell your personal data. We may disclose your data to third parties under the following circumstances, subject to statutory exemptions (Sections 60-65 of Act 843):
Regulatory and Law Enforcement Authorities: Disclosures required by law, court orders, or requests from regulatory bodies (e.g., Bank of Ghana) or tax authorities.
Credit Reference Agencies: Sharing financial data with authorised bureaus for credit assessment.
Professional Advisors: Auditors, legal counsel, and other advisors bound by confidentiality.
8. Transfer of Personal Data
NIB may transfer or store your personal data outside Ghana only when you have given explicit and informed consent, when necessary for the performance of a contract between you and the Bank, when necessary for the establishment of legal claims and when necessary to protect your vital interest. All transferred data will be subject to the provisions of the Ghana Data Protection Act. The Bank will ensure that adequate security safeguards for the protection of personal data are in place.
9. Data Security
In accordance with Section 28 of Act 843, NIB has implemented robust physical, technological, and administrative safeguards to prevent loss, damage, or unauthorised destruction of personal data, and unlawful access to or processing of personal data.
Our digital platforms employ multi-level authentication, and our data centre is monitored around the clock. In the event of a security compromise affecting your data, NIB will notify the Data Protection Commission and affected data subjects as required by Section 31 of the Act.
10. Data Retention
NIB retains records of personal data only for as long as is necessary to achieve the purpose for which the data was collected, as required by Section 24 of Act 843. NIB is required to retain information in accordance with the law, such as information needed for income tax and audit purposes. The retention period for certain kinds of personal data may also be governed by specific business-sector requirements and agreed practices.
11. Your Data Protection Rights
Under Act 843, you possess comprehensive rights regarding your personal data. NIB is committed to facilitating these rights, which include:
Right of Access (Section 32 & 35): You may request confirmation of whether we hold your data, a description of the data, the identity of third parties who have accessed it, and the source of the data.
Right to be Informed (Section 32): You have the right to know why your data is being collected, what specific data is being collected, how it will be used and who it will be shared with.
Right to Give and Withdraw Consent (Section 20): You have the right to consent or withdraw from the processing of your personal data unless when required by law, necessary for the purpose of a contract to which you are a party, necessary for the performance of statutory duty, and necessary to protect your legitimate interest.
Right to Correction and Deletion (Section 33): You may request the correction, deletion, or destruction of data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
Right to Object (Section 20): You may object to the processing of your data. Where you object, we will cease processing unless otherwise permitted by law.
Right to Prevent Processing for Direct Marketing (Section 40): You have the absolute right to require us to stop processing your data for direct marketing purposes.
Rights in Relation to Automated Decisions (Section 41): You have rights concerning decisions made solely on automated processing that significantly affect you.
Right to Prevent Processing (Section 39): You may request for your data not to be processed for a specified purpose or in a specified manner if it is likely to cause unwarranted damage to you.
Right to Complain (Section 41 & 42): You have the right to lodge a complaint with the Bank when dissatisfied with services.
Right to Compensation (Section 43): You have the right to seek compensation from the Bank or Courts if you suffer damage or distress as a result of the Bank's contravention of the Act.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within reasonable time. Occasionally it could take us longer if your request is complex. In this case, we will notify you and keep you updated.
12. Protecting Children's Privacy
The Bank recognizes that children require special protection with regard to their personal data. Where personal data relating to a child is collected or processed, the Bank shall ensure that such processing is lawful, fair, and conducted in the best interests of the child. Appropriate consent shall be obtained from a parent, guardian, or other person authorized by law where required and additional safeguards shall be implemented to protect the child's privacy, confidentiality and rights under the Data Protection Act, 2012 (Act 843).
13. Contact Information
NIB maintains a Data Protection Supervisor function (per Section 58 of Act 843) to monitor our compliance with privacy laws. If you wish to exercise your rights or have a complaint, please contact us:
