Yes, a Botswana business can send personal data outside the country. Most businesses already do this without thinking of it that way, and the Data Protection Act, 2024 sets specific conditions on when it is lawful. See international data transfers for the complete legal breakdown. This article applies that to the situations a Botswana business is actually in.

Situations you are probably already in

If any of these sound familiar, you are already sending personal data outside Botswana, whether or not anyone in the business has thought about it in those terms:

  • Using Google Workspace or Microsoft 365 for staff email, which stores mailbox data on servers outside the country.
  • Running accounting or payroll on an overseas-hosted platform, where salary and staff data sits on foreign infrastructure.
  • Using a CRM or e-commerce platform built by a foreign vendor, where customer records live on servers you have never seen and do not control.
  • Running Google Analytics or a similar tool on your website, which sends visitor data abroad by design. See cookies, Google Analytics and the DPA for more on this specific case.

None of these are exotic setups. They are the ordinary tools most Botswana businesses already run on.

None of these are exotic setups. They are the ordinary tools most Botswana businesses already run on.

What actually needs to be true for this to be lawful

The Act requires one of a set of recognised grounds to apply before personal data leaves Botswana:

  • An adequacy arrangement, where a country has been formally recognised as offering an adequate level of data protection. As far as is publicly known, this has not yet resulted in any published list of adequate countries, so most Botswana businesses cannot currently rely on this ground for any specific destination.
  • Appropriate safeguards, most practically a vendor’s own standard contractual clauses or recognised certifications. This is the ground most businesses will actually end up relying on, since it does not depend on a government-to-government arrangement being in place.
  • A specific derogation in narrower situations, such as the data subject’s explicit consent to the particular transfer.

See international data transfers for the full list and the conditions attached to each.

The requirement that gets missed: keep a copy in Botswana

Section 74 requires a copy of the data to be kept in Botswana for the period of processing, even where the transfer itself is lawful. This is easy to miss because it is not the part of the rule anyone thinks to check: businesses focus on whether the transfer is allowed and forget that “allowed” still comes with a local-copy requirement attached. If your data genuinely lives only on a foreign server with nothing retained locally, that is a gap even where the underlying transfer ground is otherwise sound.

A practical starting point

Rather than assuming a large, well-known international company must automatically be fine, work through this list for your own business:

  • List every third-party tool or platform that touches customer or staff personal data: email, payroll, CRM, accounting, analytics, e-commerce.
  • For each one, check where its servers are actually located.
  • Check what that vendor’s own terms say about data protection commitments, certifications, or standard contractual clauses.
  • Note where, if anywhere, a copy of that data is also retained in Botswana.

This is not a one-off exercise. New tools get added to a business over time, and each one is a fresh transfer to check, not something covered automatically by having looked at the last one.