Skip to content
Digital Thread

What counts as valid consent under Botswana's DPA

Valid consent under the Data Protection Act, 2024 has to be freely given, specific, informed and an unambiguous positive action by the data subject, and it has to be as easy to withdraw as it was to give. Pre-ticked boxes and consent buried in general terms and conditions do not meet that standard.

Section 2 of the Data Protection Act, 2024 defines consent, and section 27 sets the conditions it has to meet in practice. The short version: consent has to be freely given, specific, informed and an unambiguous positive action, not a default state dressed up as agreement.

“Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”

What section 27 requires

  • The controller must be able to demonstrate that consent was given. If you cannot produce a record showing someone agreed, you cannot rely on having their consent.
  • If consent is requested within a document that also covers other matters, such as a set of terms and conditions, the request for consent must be clearly distinguishable from those other matters, and written in plain and clear language.
  • The data subject has the right to withdraw consent at any time under section 28, and withdrawing it must be as easy as giving it was in the first place.
  • Pre-ticked boxes. Consent has to be a clear affirmative action by the person, not a default they have to notice and undo.
  • Consent bundled into general terms and conditions. Burying a consent clause inside a long T&Cs document, with no way to tell it apart from the rest, fails the “clearly distinguishable” requirement in section 27.
  • Making a service conditional on unnecessary consent. If a customer has to agree to marketing messages just to create an account for a service that has nothing to do with marketing, that consent is not freely given.

Where processing involves offering an online service directly to a child, section 29 sets extra conditions, including who can give consent on the child’s behalf and at what age a child can consent themselves. That is its own topic, covered in full on the children’s data page rather than repeated here.

Consent is often treated as the default legal reason for processing personal data, but section 26 sets five other lawful bases alongside it, and several everyday business activities rely on those instead. See lawful processing for the full list and when each one applies.

Educational information only, not legal advice. Source: Data Protection Act, 2024 (Act No. 18 of 2024), s.2, s.27, s.28, s.29. Last reviewed: 7 September 2026.

Questions about what counts as valid consent under botswana's dpa

No. Consent has to be an unambiguous, affirmative action by the data subject. A box that is already ticked for them does not meet the definition in section 2, because the person has not actually signified agreement themselves.
Not if the consent is unrelated to the service itself. Making a service conditional on consent it does not actually need undermines whether that consent was freely given, which is part of the definition in section 2.
Section 28 requires withdrawal to be as easy as giving consent was. If someone can opt in with one click, they need a similarly simple way to opt out, not a phone call or a written request.