As a person whose personal data a business holds, you have eight distinct rights under Botswana’s Data Protection Act, 2024. Almost nobody uses them, mostly because almost nobody knows they exist. This is a plain walkthrough of what they actually let you do.

None of this is theoretical. If a delivery company still has your old address six months after you moved, or a gym keeps calling you after you cancelled, these rights are the tool for it.

You can ask what a business holds on you, and get a copy

This is the right of access, and it is the most useful starting point because it tells you everything else you need to know. Any business that holds your personal data, a bank, a retailer, a gym, an app, has to tell you what it holds, why, and give you a copy if you ask. See the right of access for exactly what a business has to hand over.

You do not need a reason. “I want to know what you have on file” is a complete request on its own.

You do not need a reason. “I want to know what you have on file” is a complete request on its own.

You can get wrong information corrected

If a business has your name misspelled, your ID number wrong, or an old phone number still active on your account, you can ask for it to be fixed. This is the right to correction, and it applies whether the mistake was theirs or happened when your details changed and nobody updated the record.

You can ask for your data to be deleted, sometimes

This is the right people hear about most and understand least. You can ask a business to delete your personal data, but it is not automatic. A business can usually refuse if it still has a genuine reason to keep the data, a legal record-keeping requirement, an active contract with you, or a dispute that is still open. The right to deletion explains the conditions in full.

A realistic example: you cancelled a gym membership eight months ago and there is no ongoing contract, no dispute, and no legal reason for them to keep your file. That is exactly the kind of situation where a deletion request should succeed.

You can object to marketing, and it has to actually stop

If a business is sending you marketing messages, calls, or SMS promotions, you can object and they are required to stop using your data for that purpose. This is the right to object, and it applies most cleanly to direct marketing specifically. See direct marketing for how marketing consent and opt-outs are supposed to work in the first place.

The gym-calling-after-cancellation example fits here too. If they are still contacting you to sell you a renewal, and you have told them to stop, that call should not be happening.

You can push back on a fully automated decision that affects you

If a business makes a significant decision about you using an automated process alone, no human involved, like an automatic loan or credit rejection generated purely by an algorithm, you have a right to challenge that decision and ask for human involvement. This is covered in automated decision-making. It matters most in situations like credit scoring, insurance pricing, or automated eligibility checks, where the outcome has a real effect on you and no person actually looked at your case.

How this works in practice

A business has one month to respond once you make any of these requests. That timeline, and the practical mechanics of how to actually exercise a right, whether it needs to be in writing, whether a business can ask you to verify your identity first, is covered on how to exercise your rights.

If a business ignores your request, or refuses it without a proper reason, you do not have to just accept that. You can complain to the Information and Data Protection Commission, and doing so is free. See complaints for how that process works.

A realistic example, start to finish

Say a courier company still has your old address on file, months after you moved, and keeps sending your parcels to the wrong place. You can:

  • Ask them what address they hold on file for you (right of access).
  • Ask them to correct it (right to correction).
  • If they refuse to fix it or simply do not respond within a month, take that to the Commission as a complaint.

None of this requires a lawyer, a fee, or specialist legal knowledge. It requires knowing the rights exist, which is the part most people are missing.