Your vendors are telling your board to move its data home. Read the directive first.

The papers are usually well intentioned. Many of them are also written, directly or indirectly, by people who sell infrastructure in Ghana.

Before your board approves that spend, it is worth reading what the directive says rather than what it is being reported to say.

Two provisions matter most, and they are narrower and more specific than the summaries suggest.

The first concerns security monitoring. Where a regulated institution subscribes to a SIEM service, the directive requires that it be operated by an entity accredited by the Cyber Security Authority with Ghanaian majority shareholding. That is a genuine localisation requirement, it is unambiguous, and it will require action from a number of institutions that currently buy monitoring from abroad.

The second concerns managed security service providers. Contracts must address data sovereignty, with data remaining within jurisdictions approved by the Bank of Ghana. Read that phrase carefully. It is not Ghana only. It is jurisdictions the regulator approves, which is a different and more workable test.

The directive also sets out an extensive cloud computing regime covering governance, risk management, contracts, operations, resilience and security assurance. What it does not do, in the sections dealing with cloud, is impose a blanket requirement that all sensitive data reside on Ghanaian soil.

There is a real distinction between a regulator saying "you may not do this" and a regulator saying "you must be able to show me how you control this". The directive leans heavily towards the second. That is a harder discipline in some ways, and a cheaper one in most.

Three reasons, and none of them are conspiratorial.

The Governor said publicly that the directive does not endorse wholesale migration of core systems or sensitive data to the cloud. That is a warning against a casual lift and shift. It reads, when quoted alone, like a prohibition.

Second, a directive is a long technical document and very few directors will read it end to end. Summaries fill that gap, and the summary with the most urgency travels furthest.

Third, the strong reading creates work. Repatriation is a large, well defined, immediately sellable programme. The precise reading creates a governance exercise instead, which sells to nobody.

Read the primary text, or have someone independent read it for you. Not a vendor summary. Not a news article. Not this article. The directive is published by the Bank of Ghana and it is the only thing your board will be held to.

Separate the three obligations. The SIEM accreditation requirement is specific and probably actionable now. The MSSP contract requirement is a contracting exercise your legal team can run. The cloud regime is a governance and assurance exercise. Treating all three as one repatriation programme is how institutions overspend.

Ask who wrote the paper. If the recommendation is to buy local infrastructure and the paper was prepared with help from a firm that sells local infrastructure, that is not misconduct, it is ordinary commercial life. It is also a reason for the board to get a second view before committing capital.

Write to the regulator if you are unsure. Where the directive turns on jurisdictions approved by the Bank of Ghana, the sensible course is to ask which jurisdictions are approved rather than to guess expensively. Regulators generally prefer the institution that asks.

Record the decision properly. Whatever your board concludes, the minute should show that the board read the requirement, considered the options, understood the cost of each, and chose deliberately. If the position is later challenged, that record is your defence. A minute saying the board approved a repatriation programme on the recommendation of a vendor is not.

Data sovereignty is going to be a recurring board question in Ghana, not a one off. The direction of regulation across the continent is towards greater control over where financial and personal data sits and who can reach it. Boards that build the habit of reading the primary text and asking who benefits from a given interpretation will handle the next five directives better than boards that outsource the reading.

The institutions that get this wrong will not be the ones that ignored the directive. They will be the ones that over complied, at speed, on advice from someone with an interest in the answer.

One caution, offered in the spirit of the article. The reading above is based on the published directive, but it is a long document and interpretation of specific clauses should be confirmed with counsel and with the Bank of Ghana. Do not act on any summary, including this one, without checking the text.