What must a business do to comply with the Data Protection Act?

Sections 51 to 73 of the Data Protection Act, 2024, spread across Parts X to XIII, set out what a controller or processor actually has to do once it has worked out its lawful basis for processing. This page is a map of those obligations. Each one gets its own full page in this guide, linked below.

Accountability comes first (s.51)

Section 51 sets the tone for everything else in this part of the Act. A controller is responsible for complying with the obligations that follow, and must be able to demonstrate that compliance, not just assert it. Every obligation below is really a way of building that evidence: a written record, a documented set of measures, or a role with clear responsibility attached to it.

The obligations, one by one

• Data protection by design and by default (s.52): build data protection into systems and processes from the design stage, and default to collecting and using no more personal data than each specific purpose needs.
• Appointing a local representative (s.54): a controller or processor not established in Botswana, but caught by the Act’s extraterritorial scope, generally needs to designate a representative established in Botswana.
• Processor contracts (ss.55 to 59): a controller can only use a processor bound by a written contract that covers specific required content, not just a general service agreement.
• Records of processing (s.60): keep a written record of what personal data is processed, why, and for how long, with a limited exemption for smaller enterprises.
• Security measures (s.62): put technical and organisational measures in place that match the risk of the processing.
• Breach notification (ss.63 and 64): notify the Commission, and in some cases the affected people themselves, when personal data is compromised.
• Impact assessments (ss.65 to 68): assess high-risk processing before it starts, and consult the Commission first if serious risk remains after mitigation.
• Data protection officers (ss.69 to 73): appoint one, mandatorily in three specific situations and optionally otherwise.

None of this is a one-off exercise

A controller cannot complete these obligations once and file them away. A record of processing goes stale the moment you start collecting a new type of data. Security measures need to be tested against a new risk. A processor contract needs to be checked when you switch providers. Section 51’s accountability requirement is really asking for an ongoing practice, not a document you can point to and forget.

Which of these obligations carry the most weight for a given business depends on what it actually does with personal data. A five-person retail shop with a customer list and a payroll spreadsheet has a lighter set of practical requirements than a clinic running patient records or a company operating CCTV across a shopping centre, but the underlying obligations in sections 51 to 73 are the same ones for both. The pages linked above go through each in the detail a business actually needs to act on it.