What is a data controller under Botswana's Data Protection Act?

A data controller is whoever decides why personal data is being processed and how. Section 2 of the Act defines a data controller as:

a person or public authority which, alone or jointly with others, and in accordance with Part X, determines the purposes and means of the processing of personal data.

The important part of that definition is “determines the purposes and means.” The controller is not necessarily the person typing information into a spreadsheet. It is whoever decided, in the first place, that the spreadsheet should exist, what it is for, and how the information in it gets used. In most small and medium Botswana businesses, that is simply the business itself: the owner or management decide to keep a customer database, an HR file or a supplier list, and the business is the controller of that data.

An example

A private school that decides to keep a database of parents’ contact details, so it can send fee reminders and event notices, is the controller of that data. The school decided why the data is being collected, to communicate with parents, and how it is used, for fee reminders and notices. It does not matter whether the database sits in a spreadsheet, a school management system, or a paper register: the school is the controller either way.

Joint controllers

Section 53 allows for joint controllers, where two or more parties jointly determine the purposes and means of processing the same personal data. This page does not go into how that arrangement has to work between the parties, only that the concept exists in the Act.

How to tell if your business is the controller

Ask who decided the data should be collected in the first place, and who decided what it would be used for. If the answer to both is your own business, rather than a client or another organisation instructing you, your business is the controller of that data. Most Botswana businesses collecting their own customer or staff records, for their own purposes, are controllers of that data by default.

Controller or processor?

A controller is not the same as a data processor, which processes personal data on a controller’s instructions rather than deciding why or how it happens in the first place. A payroll company handling a business’s employee data on that business’s instructions is a processor, while the business itself remains the controller.

What a controller actually has to do

Being a controller comes with obligations under the Act, covering things like security, records of processing, and how the business responds to data subjects exercising their rights. Those are covered in full on business obligations. This page is only about identifying what a controller is, not a full account of what one must do.