Can an Employer Collect Employee Personal Data in Botswana?

Yes. An employer in Botswana can, and generally needs to, collect a fair amount of personal data to run payroll, benefits and basic HR. Names, ID numbers, bank details, next of kin, leave records, none of that is off limits. What surprises some employers is that none of it gets a workplace exemption from the Data Protection Act, 2024 either. The Act applies to employee data the same way it applies to customer data.

What lawful basis covers ordinary HR data

Most day-to-day HR processing relies on the contract basis under section 26(b), not consent. Paying a salary, administering leave, enrolling someone in a medical aid scheme, all of that is necessary to perform the employment contract itself. See lawful processing for the full list of six bases.

Consent is usually the wrong basis to reach for in an employment relationship. The Act treats consent as only valid where it is freely given, and there is a real power imbalance between an employer and an employee: someone rarely feels free to refuse a request from the person who pays them. Relying on consent for core HR processing also creates a problem later, since consent can be withdrawn, and payroll is not something an employee can simply opt out of. Contract necessity does not have that weakness, which is why it is the basis that actually fits.

Someone rarely feels free to refuse a request from the person who pays them.

Sensitive personal data shows up in HR more than employers expect

A fair amount of what an HR department handles falls into the sensitive category, which carries extra conditions under sensitive personal data and sensitive data processing:

• Health information, wherever sick leave certificates, medical aid claims, or workplace injury records are involved.
• Biometric data, if the business uses a fingerprint or facial time clock for attendance.
• Religious or trade union information, where it is relevant to leave arrangements, prayer accommodations, or union membership.

None of this means an employer cannot hold it. It means the ordinary contract-necessity basis is not enough on its own for these categories, and a separate, stricter basis under section 30 needs to apply.

Data minimisation applies to HR systems too

A common, avoidable mistake is scanning a copy of an employee’s national ID into every HR system the business later adopts, a payroll tool, a benefits portal, a scheduling app, because it was collected once and is sitting in a folder. The principles require data to be limited to what each specific purpose actually needs. If a new system does not need the ID copy to function, it should not be fed a copy just because one already exists.

CCTV in the workplace

This is one of the most common real questions in Botswana workplaces, and it deserves a straight answer.

CCTV needs a legitimate purpose, security being the obvious one, and should avoid unnecessarily invasive placement. Cameras inside bathrooms or break rooms are the kind of placement that is hard to justify under any purpose. Where CCTV is used for something beyond simple security, for example detailed monitoring of worker productivity or behaviour, that use edges toward requiring a data protection impact assessment, particularly if it is done at scale across a workforce. See DPIA for what triggers that requirement and what it involves.

Employees have data subject rights too

An employee is a data subject like any customer is. A staff member can request their own HR file under the right of access, the same right a customer would use to ask what a business holds on them. Employers sometimes treat this as an unusual or hostile request when it comes from staff. It is not: it is the same right, applied to the same employer, from a different kind of data subject.

Records of processing can apply even to smaller employers

The general records-of-processing exemption for enterprises under 250 employees does not hold once sensitive personal data is involved. An HR department handling health records or biometric time-clock data may need to keep a proper record of that processing under records of processing, even if the business itself is small by any other measure.

What to do with exiting employee data

When someone leaves, their HR file does not need to disappear immediately, but it also should not sit indefinitely on a “just in case” basis. There should be a genuine, documented reason for how long exiting employee data is kept, tied to an actual purpose: a statutory record-keeping period, a possible reference request, a dispute window. See data retention for how to work that reasoning out properly rather than defaulting to keeping everything forever.