Short answer: yes. The Data Protection Act, 2024 does not have a general small business exemption. If you collect a customer’s phone number to send them a delivery update, or keep a spreadsheet of staff ID numbers for payroll, the Act applies to you the same way it applies to a bank.

The Act applies to you the same way it applies to a bank.

There is exactly one place in the Act where business size changes what you have to do, and it is worth understanding precisely, because it is not the blanket exemption a lot of owners assume exists.

The one size-based exemption

Section 60 requires controllers and processors to keep a Record of Processing Activities: a written account of what personal data you process, why, who you share it with, and how long you keep it. That record has to be made available to the Information and Data Protection Commission on request.

An enterprise employing fewer than 250 people does not have to keep this record, unless one of three things is true:

  • the processing is likely to result in a risk to the rights of the people whose data it is,
  • the processing is not occasional, or
  • it includes sensitive personal data or data relating to criminal convictions.

In practice, that third condition catches a lot of small businesses anyway. A clinic with four staff processing patient health records is well under 250 employees, but health data is sensitive personal data, so the exemption does not apply. A five-person retail shop that only ever collects a customer’s name and phone number for delivery, on the other hand, likely does qualify for it, because that processing is neither risky, non-occasional in the sense the Act means, nor sensitive.

Everything else applies regardless of size

Outside that one section, nothing in the Act reads “small businesses are exempt from this.” The core obligations apply the same way to a five-person business as they do to a bank:

  • The principles in Part IV (lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security, accountability) apply to any processing, of any size.
  • A lawful basis is still required for every piece of personal data you process, whether that is one customer’s number or a hundred thousand.
  • Data subject rights still apply. A customer can still ask you what data you hold on them and ask you to correct or delete it, and you still have to respond within a month.
  • Breach notification still applies. If a small business’s customer database leaks, the 72-hour notification rule to the Commission is the same rule that applies to a large one.
  • Security obligations under section 62 are not scaled down for smaller operations. The Act requires security measures “appropriate” to the risk, which is a real qualifier, but it is not the same thing as a size exemption.

What this actually means for a small business

If you run a small business in Botswana and handle customer or staff personal data, treat the Act as applying to you in full unless you can specifically point to the section 60 exemption applying to your situation. Two things are usually worth doing regardless of size: work out what personal data you actually collect and why, and have a plain, accurate privacy notice that tells people what you do with it. Both of those come from Part IV’s principles, not from any size threshold, so there is no version of the Act where a small business skips them.

If you are trying to work out whether your specific processing counts as “occasional” or carries a “risk” for the purposes of the section 60 exemption, that is a judgement call the Act does not define precisely, and getting it wrong has the same consequences regardless of how small the business is.