Administrative fines of up to P50,000,000, or 4% of worldwide annual turnover, whichever route applies to the contravention, for the most serious breaches. Separate criminal penalties of up to P500,000, or up to 9 years in prison, for individuals. Penalties has the complete breakdown of every figure and which contravention triggers which tier. This article is about making those numbers land with the real stakes behind them.
Why there are two ways to calculate the fine
A flat cap sounds simple until you picture a genuinely large company sitting next to a small one. P50,000,000 might be a serious blow to a small business and barely register against the accounts of a large multinational operating in Botswana. That’s why the Act also gives the option of a percentage of worldwide annual turnover, so the fine can scale to the size of the organisation being fined, rather than treating a company turning over P2 million and one turning over P2 billion the same way.
Take a mid-sized Botswana company with an annual turnover of P20 million. If it commits a serious, unaddressed data subject rights violation, the fine isn’t necessarily calculated off the flat figure. Worked out as 4% of that P20 million turnover, the fine comes to P800,000. That’s a meaningful number for a company that size, and it shows exactly why the percentage option exists: to make sure a fine actually stings in proportion to what a company earns, not only in absolute terms against a fixed ceiling.
Two separate tracks, and both can apply
It’s worth being clear that these aren’t alternative routes to the same outcome. They’re two entirely separate mechanisms that can both land on the same bad conduct. The administrative fine punishes the organisation. The criminal offence can land on an individual within it, a director, a manager, whoever the conduct is traced to. Neither one applying rules out the other. A company can face an administrative fine for the same conduct that also results in an individual being criminally prosecuted for it.
It’s not only about the money
Financial penalties aren’t the only lever available. The Commission’s corrective powers include ordering a business to stop a specific processing activity altogether, or issuing a public compliance order. For a lot of businesses, particularly ones that depend on customer trust to operate, a public order or an enforced processing ban can do more lasting damage than the fine itself, because it’s visible, and it doesn’t go away once a cheque has been paid.
A public order or an enforced processing ban can do more lasting damage than the fine itself, because it’s visible, and it doesn’t go away once a cheque has been paid.
Why the figures are this size
These numbers exist for a specific reason: to make basic compliance, the kind covered throughout this guide, cheaper than getting it wrong. A business that budgets for proper consent practices, a real breach response plan, and accurate records of processing is spending far less than P800,000, let alone P50,000,000. The fines aren’t set at a level meant to be shrugged off as a cost of doing business. They’re set at a level meant to make sure it never makes financial sense to treat compliance as optional.
