Data Protection Guide

Botswana's Data Protection Act, 2024, explained

The Act runs to 101 sections across 17 parts. Most people only need to understand a handful of them at a time. Pick a topic below and start there.

Nothing matches that yet. Try a different word, or browse the topics below.

Getting started

The basic vocabulary of the Act: who it covers, and the terms everything else builds on.

What is the Data Protection Act, 2024?

The Data Protection Act, 2024 (Act No. 18 of 2024) is Botswana's law on how personal data must be collected, used, stored and shared. It came into force on 14 January 2025, replacing the Data Protection Act, 2018.

Explore

Who does the Data Protection Act apply to?

The Act applies to any business that processes personal data by computer or through a manual filing system in Botswana. It also reaches foreign businesses that target or track people in Botswana, even without a local office.

Explore

What counts as personal data under Botswana's Data Protection Act?

Personal data is any information relating to an identified or identifiable natural person, such as a name, an Omang number, or a delivery address. It only covers information about people, not companies.

Explore

What is sensitive personal data under Botswana's Data Protection Act?

Sensitive personal data is a narrower category of personal data covering things like health information, biometric data, religious belief and political opinion. It carries extra restrictions beyond the Act's general rules.

Explore

What is a data controller under Botswana's Data Protection Act?

A data controller is the person or organisation that decides why and how personal data is processed. In most small and medium Botswana businesses, that is simply the business itself.

Explore

What is a data processor under Botswana's Data Protection Act?

A data processor is a person or business that processes personal data on behalf of a data controller, rather than deciding why or how that data is used. A payroll company processing a client's staff data is a typical example.

Explore

Principles and lawful processing

The rules that apply to every piece of personal data a business touches, and the grounds that make processing it lawful.

The data protection principles under Botswana's DPA

Sections 19 to 25 of the Data Protection Act, 2024 set seven principles that apply to every processing of personal data in Botswana: lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

Explore

Lawful bases for processing personal data in Botswana

Section 26 of the Data Protection Act, 2024 sets six lawful bases for processing personal data, at least one of which must apply before you process anyone's personal data. Consent is one of the six, not the default and not the only option.

Explore

What counts as valid consent under Botswana's DPA

Valid consent under the Data Protection Act, 2024 has to be freely given, specific, informed and an unambiguous positive action by the data subject, and it has to be as easy to withdraw as it was to give. Pre-ticked boxes and consent buried in general terms and conditions do not meet that standard.

Explore

Can you process sensitive personal data in Botswana?

Processing sensitive personal data in Botswana is prohibited by default under section 30(1) of the Data Protection Act, 2024. You may only process it if one of ten specific conditions listed in section 30(2) applies, and consent is only one of those ten.

Explore

Children's data and consent under Botswana's DPA

Under section 29 of the Data Protection Act, 2024, offering an online service directly to a child is lawful only with consent from a parent or person holding parental responsibility, unless the child is 16, in which case they may consent themselves.

Explore

Data subject rights

What a person can ask a business to do with their own data, and how those requests actually work.

Data subject rights under the Data Protection Act

Part VIII of the Data Protection Act, 2024 (sections 37 to 49) gives every data subject eight specific rights over their own personal data, and sets out how a business must handle requests to use them.

Explore

Obligations for businesses

What controllers and processors are required to do, from security to breach notification to appointing a DPO.

What must a business do to comply with the Data Protection Act?

Sections 51 to 73 of the Data Protection Act, 2024 require a controller to build data protection into its systems, secure personal data, keep records, notify breaches, assess high-risk processing and, in some cases, appoint a data protection officer. Section 51 makes a controller responsible for, and able to demonstrate, all of it.

Explore

Data protection by design and by default in Botswana

Section 52 requires a controller to build appropriate technical and organisational measures into its processing from the design stage onward, and to default to processing only the personal data a specific purpose actually needs, in amount collected, extent of processing, storage period and accessibility.

Explore

Does a foreign business need a representative in Botswana?

In most cases, yes. Section 54 requires a controller or processor not established in Botswana, but caught by the Act's extraterritorial scope, to designate a representative established in Botswana in writing, unless a narrow exemption applies.

Explore

Data processing agreement requirements under Botswana's DPA

Sections 55 to 59 require a controller to use only a processor that offers sufficient guarantees of appropriate measures, bound by a written contract covering specific mandatory content. A processor cannot bring in a sub-processor without the controller's prior written authorisation, and remains liable for that sub-processor's failures.

Explore

Record of processing activities: what Botswana's DPA requires

Section 60 requires a controller or processor to maintain a written record of processing activities, made available to the Commission on request. Enterprises with fewer than 250 employees are exempt, but only where the processing is occasional, unlikely to risk data subjects' rights, and does not involve sensitive or criminal-conviction data.

Explore

Data security requirements under the Data Protection Act

Section 62 requires a controller and processor to implement security measures appropriate to the risk of the processing, taking into account the state of the art, cost, and the nature, scope and purposes of processing, covering things like encryption, ongoing system resilience, incident recovery and regular testing.

Explore

How long do you have to report a data breach in Botswana?

A controller must notify the Commission of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to data subjects. Where the breach is likely to result in a high risk, the controller must also tell the affected data subjects directly.

Explore

When is a data protection impact assessment required in Botswana?

A data protection impact assessment is required under section 65 before processing that is likely to result in a high risk to individuals, including automated profiling with legal or similarly significant effects, large-scale processing of sensitive or criminal-conviction data, and large-scale monitoring of a public area.

Explore

What is a data protection officer under Botswana's Data Protection Act?

A data protection officer is mandatory under section 69 only in three cases: public authorities, businesses whose core activity involves regular and systematic monitoring of individuals on a large scale, and businesses whose core activity involves large-scale processing of sensitive or criminal-conviction data. Outside those three cases, appointing one is optional.

Explore

Cross-border data transfers

The rules for sending personal data outside Botswana.

Can you send personal data outside Botswana?

Personal data can be sent outside Botswana only where the transfer rests on an adequacy decision, appropriate safeguards such as standard clauses, approved binding corporate rules, or one of a short list of exceptions, and a copy of the data must stay in Botswana while it is being processed.

Explore

The regulator and enforcement

The Information and Data Protection Commission, how complaints work, and what non-compliance actually costs.

What is the Information and Data Protection Commission?

The Information and Data Protection Commission (IDPC) is Botswana's supervisory authority for data protection, continued rather than newly created by the Data Protection Act, 2024. It has enforcement, investigative and advisory powers, though as of the most recent reporting it still lacked a permanent office and a public website.

Explore

How to complain to the Data Protection Commission

A data subject can lodge a free complaint with the Information and Data Protection Commission under section 80, and the Commission must keep them informed of progress and outcome. Because the Commission has no published contact details yet, the realistic first step for most people is raising the issue with the business directly.

Explore

What are the penalties for breaching the Data Protection Act?

Breaching the Data Protection Act, 2024 can mean an administrative fine of up to P10 million or P50 million (or 2% or 4% of worldwide turnover, whichever is higher), on top of criminal penalties of a P500,000 fine and up to 9 or 10 years' imprisonment, depending on the offence.

Explore

How to appeal a Data Protection Commission decision

A person aggrieved by a decision of the Commissioner can appeal to the Information and Data Protection Appeals Tribunal within 30 days, and a further appeal from the Tribunal's decision lies to the High Court.

Explore

Marketing and retention

Two areas businesses ask about constantly, where the Act says less than most people assume.

Direct marketing rules under Botswana's Data Protection Act

Botswana's Data Protection Act, 2024 does not have a dedicated direct marketing regime. It gives data subjects an absolute right to object to marketing at any time under section 48(3) to (5), which a business must tell them about upfront, but sending a first marketing message still only needs an ordinary lawful basis, not separate marketing consent.

Explore

How long can a business keep personal data in Botswana?

Botswana's Data Protection Act, 2024 does not set any fixed retention period for any category of data. Section 23 instead requires personal data to be kept no longer than necessary for the purpose it was collected for, and section 40 requires businesses to state their retention period or the criteria for it at the point of collection.

Explore

Digital Thread Blog

Looking for a specific situation?

The guide above explains what the Act says. Our blog covers what that means in practice: privacy policies, HR data, marketing consent, and the questions Botswana businesses actually ask us.

Visit the blog

Need this handled, not just explained?

Digital Thread helps Botswana businesses comply

Gap assessments, privacy policies, consent systems, and ongoing support from a team that works with the Act every day.

See our compliance service

This guide is educational information, not legal advice, and reflects our reading of the Data Protection Act, 2024 (Act No. 18 of 2024) as published in the Government Gazette. Where the Act is silent on a point, we say so rather than guess. For advice on your specific circumstances, speak to a qualified lawyer or contact us at admin@digitalthread.online.