Only in three specific situations, and most small and medium Botswana businesses don’t fall into any of them. A handful of common business types do meet one of the three without realising it, though. Data protection officer covers the exact statutory conditions in full. This article applies them to real business types, so you can work out where yours actually sits.
Trigger one: you’re a public authority or government body
If that’s what you are, you need a DPO, no size threshold, no exceptions. This one is straightforward and doesn’t need much unpacking: it applies by category, not by how much data the body actually processes or how many people it employs.
Trigger two: your core activity is large-scale, systematic monitoring of people
This is about what the business fundamentally does, not whether it happens to own a camera. A security company running large-scale CCTV or monitoring services for clients needs a DPO, because monitoring people at scale is the actual service being sold. A digital ad-tech platform that tracks user behaviour across sites and apps at scale needs one for the same reason: tracking people, systematically and continuously, is the core of what the business does, not something incidental to some other product.
Monitoring people at scale is the actual service being sold.
Compare that to a normal retail shop with an ordinary CCTV camera at the till. That shop is also monitoring people, technically, but monitoring isn’t its core activity, it’s a security measure sitting alongside the actual business of selling things. That shop doesn’t need a DPO on this basis, and treating every camera as a trigger for this requirement would misread what the trigger is actually aimed at.
Trigger three: your core activity is large-scale processing of sensitive personal data or criminal-conviction data
A private hospital or a large diagnostic lab processes sensitive personal data, patient health records, as its core activity, at real scale, so it needs a DPO. A small clinic with a handful of patients is a greyer case. It’s processing the same category of data, health information, but nowhere near the same scale, and “large-scale” is doing real work in this trigger rather than being a formality. It’s worth an actual lawyer’s opinion for a business sitting right on that line, but a small clinic likely doesn’t meet the bar this trigger sets.
Outside the three triggers
None of this means a DPO is off the table for a business that doesn’t strictly need one. Appointing one voluntarily is a reasonable move for a business growing quickly, or one that handles data it’s genuinely nervous about, even without a legal requirement forcing the decision. The Act also explicitly allows a group of related businesses to share a single DPO, so this doesn’t have to mean a new full-time hire for every entity in a group, just one appointment covering all of them.
If you’re not sure which side of that line your business falls on, or want a DPO without hiring one full time, that’s something we help with.
