The Data Protection Act, 2024 does not set a fixed retention period, in years or months, for any category of personal data. This is worth being direct about, because it corrects a genuinely common misconception. If someone tells you the Act requires deleting customer records after five years, or that staff files must go after seven, they are either thinking of a different law entirely, most likely tax or accounting record-keeping rules, or they are simply wrong. For the full legal detail behind storage limitation, see data retention. This article is the practical companion: what a business actually does with that principle.

Start from the purpose, not a number

Section 23’s storage limitation principle asks one question: how long does the purpose you collected this data for actually last? Once you can answer that, the retention period follows.

  • A job applicant’s CV, for someone who was not hired, is no longer needed once the role is filled and any legal challenge window around the hiring decision has passed. Keeping every unsuccessful applicant’s CV indefinitely, on the chance a similar role opens later, is not a purpose the Act recognises as ongoing.
  • An active customer’s order history is needed for as long as they might reasonably raise a warranty claim, dispute a charge, or need support referencing that order. That is a genuine, ongoing purpose, so a longer retention period is defensible here than for the CV example.

The test is not “how long is convenient to keep this” or “how long until someone asks us to delete it.” It is “does the reason we collected this still exist.”

Check whether another law sets its own period, separately

This is the part that causes the most confusion. Other Botswana laws, most notably tax and accounting record-keeping requirements, independently require certain records to be kept for a set period. Those obligations exist entirely separately from the Data Protection Act, and they are not a “DPA retention period.” A business that keeps five years of invoices because tax law requires it is complying with tax law, not with a rule the Data Protection Act itself imposes. Do not conflate the two when explaining your retention practice, and do not assume that because one law sets a fixed period, the Data Protection Act does the same for everything else you hold.

Document the reasoning

A business has to be able to tell a data subject the retention period, or at least the criteria used to set it, at the point of collection. That means the reasoning above, purpose plus any independent legal requirement, needs to actually be written down somewhere, not worked out for the first time when someone asks. See data retention for the exact section reference and what a defensible retention schedule looks like in more detail.

It is not a harmless leftover sitting quietly in storage, it is a real, correctable compliance gap.

A worked example of a real gap

Picture a five-year-old customer enquiry sitting in a database: someone asked about a product, never bought it, and the conversation went nowhere. There is no active relationship, no order to support, no legal record-keeping requirement attached to it. That record has no purpose left. It is not a harmless leftover sitting quietly in storage, it is a real, correctable compliance gap: personal data being held with no basis for continuing to hold it.

The fix is not complicated. It is going through what you actually hold, asking honestly whether the original purpose still applies, and deleting or anonymising what does not survive that question. Most businesses have more of these five-year-old enquiries sitting around than they realise, precisely because nothing in the Act forces the question until someone asks it directly.