Most Botswana business websites make the same handful of avoidable mistakes. None of them require a lawyer to fix, just attention. Here are the five Digital Thread sees most often, each tied to a specific requirement under the Data Protection Act, 2024, with a direct fix for each.
1. No privacy notice, or one copy-pasted from an overseas template
A surprising number of sites either have no privacy notice at all, or one that was clearly lifted from an overseas template: it references GDPR, names a foreign regulator, or talks about rights that do not match what Botswana’s Act actually gives people. See what should a privacy policy contain for what actually belongs in one.
The fix: write a privacy notice for your actual business, naming the Data Protection Act, 2024 and the Information and Data Protection Commission, describing what you actually collect and why. It does not need to be long. It needs to be accurate.
2. Contact forms and newsletter signups that collect too much
A newsletter signup asking for a phone number and physical address it never uses, or a contact form with fields for information nobody on the business side ever looks at, is a data minimisation problem. Section 21 requires personal data to be limited to what a purpose actually needs. See principles for the full principle.
The fix: go through every form field on the site and ask whether the business genuinely uses what it collects there. If a field’s answer never gets read or acted on, remove the field.
If a field’s answer never gets read or acted on, remove the field.
3. Analytics or marketing scripts that fire before any cookie choice
A cookie banner that exists on the page while Google Analytics or a marketing pixel is already running underneath it means tracking is happening regardless of what the visitor decides. This is one of the most common gaps because it is invisible unless someone actually checks. See cookies, Google Analytics and the DPA for the full explanation of why this matters.
The fix: configure tracking scripts to load only after a visitor makes a choice, not before, and test it by checking network activity with the banner still showing.
4. No real way for a visitor to exercise their rights
A generic “contact us” page, that either goes to a shared inbox nobody monitors or leads nowhere in practice, is not a functioning way for someone to request their data or unsubscribe from marketing. See how to exercise your rights for what a business actually owes someone who makes this kind of request.
The fix: name a specific email address or contact route for data requests in the privacy notice, and make sure whoever receives it actually knows what to do when a request comes in.
5. Old data sitting indefinitely with no review
Form submissions, abandoned signups, and customer records from years ago often just sit in a database or spreadsheet with no ongoing purpose and no process for anyone to ever look at them again. See data retention for how to work out when data like this should actually go.
The fix: set a recurring reminder, even a basic quarterly one, to review old form submissions and customer records and decide, deliberately, whether each batch still has a purpose.
Fixing these five things is not the whole job
These five mistakes are the most common, most visible gaps Digital Thread sees on Botswana business websites, and they are genuinely the easiest wins available. Fixing all five does not make a website, or the business behind it, fully compliant on its own. Compliance is broader than the website: it covers staff data, physical records, third-party contracts, and more. See business obligations for the fuller picture. But if none of these five apply to your site anymore, you are already ahead of most.
