Children's data and consent under Botswana's DPA

Section 29 of the Data Protection Act, 2024 deals with children and information society services, meaning online or digital services offered directly to a child. Where that is what is happening, processing is lawful only with consent given or authorised by a parent or person holding parental responsibility under the Children’s Act, subject to one proviso: a child aged 16 may give consent themselves, in a manner to be prescribed.

Parental consent is the default (s.29(1))

Where a business offers an information society service directly to a child, below the age at which the proviso applies, the lawful path to consent runs through a parent or person holding parental responsibility, not the child directly. A Botswana ed-tech app aimed at learners under 16 needs consent from a parent or guardian; a signup checkbox ticked by the child alone does not satisfy section 29.

The proviso: consent from age 16

The same section carves out an exception for children aged 16: they may give consent themselves, in a manner still to be prescribed. An app or platform aimed at 16 and 17 year olds can rely on the child’s own consent under this proviso, rather than routing every signup through a parent.

Verifying who actually consented (s.29(2))

Section 29(2) puts the burden on the controller to make reasonable efforts, taking available technology into account, to verify that consent was given or authorised by the holder of parental responsibility, where the child is below the age covered by the proviso. What counts as a reasonable effort is not fixed by the Act; it depends on what verification technology is realistically available.

Legitimate interests are harder to rely on for children (s.26(f)(i))

Outside of consent, section 26(f) allows processing based on the legitimate interests of a controller or third party, but that basis can be overridden by the data subject’s rights and freedoms, and section 26(f)(i) makes clear those rights and freedoms carry more weight where the data subject is a child. In practice, a business cannot lean on “legitimate interests” for a child’s data as readily as it could for an adult’s, in situations covered by lawful processing.

What age counts as a “child”?

The Act itself does not restate a specific age in section 29; it applies to children as a category defined by cross-reference to the Children’s Act. It is commonly reported that Botswana’s Children’s Act treats a person under 18 as a child, but that figure is worth treating as commonly cited background rather than a directly quoted provision of the Data Protection Act itself.

Practical example

A Botswana ed-tech app aimed at learners under 16 needs a parent or guardian to give or authorise consent before it can process the child’s personal data, not just a box the child ticks themselves during signup. A similar app aimed specifically at 16 and 17 year olds can instead rely on the child’s own consent, under the proviso in section 29. See consent for what makes any consent, adult or child, valid in the first place.