Personal data is broader than most people assume. It is any information that can be linked to an identifiable natural person, not just a name or an Omang number. Botswana’s Data Protection Act, 2024 sets the formal definition in section 2, covered in full on what counts as personal data. This article is about the question that actually comes up day to day: does this specific thing I’m holding count?
Common cases businesses actually run into
A customer’s phone number. Yes. It identifies a specific person, and a business can use it to reach them directly.
A car’s number plate, on its own, with no owner attached. Generally no. A number plate by itself doesn’t tell you who is driving the car. It only becomes personal data once it can be linked, by the business or by someone else with reasonable access, to the name of a specific person, for example through a vehicle register or a parking booking system.
A delivery address. Yes, if it’s tied to a name. An address on its own, with nothing linking it to a person, is just a location. An address attached to “deliver to Thabo Molefe” is personal data, because it now identifies where a specific person can be found.
An employee’s fingerprint used for a time clock. Yes, and it goes further than ordinary personal data. A fingerprint used to identify someone is biometric data, which the Act treats as sensitive personal data. That means it carries extra conditions before a business can process it at all, on top of the general rules.
A company’s general email address, like info@business.co.bw. No. That inbox identifies a business, not a natural person, so it falls outside the Act’s definition. A named work email, like john@business.co.bw, is a different matter: it identifies John specifically, so it counts as his personal data even though it’s a work account.
A genuinely anonymised dataset. No, not while it stays properly anonymised. If a business strips out everything that could tie a record back to a person, and there’s no reasonable way to reverse that, it falls outside the Act. Be honest with yourself about the bar here, though: true anonymisation is difficult to achieve and even harder to prove after the fact. Most of what businesses call “anonymised” is actually pseudonymised, meaning names are swapped for codes or reference numbers while a key still exists somewhere to re-link them. Pseudonymised data usually still counts as personal data, because it can be traced back.
True anonymisation is difficult to achieve and even harder to prove after the fact.
The practical test
When you’re not sure, ask one question: could this information, on its own or combined with other information that your business or someone else reasonably has access to, identify a specific person? If the answer is yes, treat it as personal data and apply the Act’s rules to it. If the answer is genuinely no, and stays no even after considering what else could reasonably be combined with it, it likely sits outside the definition.
That “combined with other information” part is where most businesses get caught out. A spreadsheet of order numbers on its own looks harmless, until you remember it sits in the same system as a customer table with names attached. At that point the order numbers are personal data too, because they’re identifiable in context, not because of anything about the numbers themselves.
