What is a data processor under Botswana's Data Protection Act?

A data processor is a person or business that processes personal data on someone else’s behalf, rather than deciding why or how that data gets used in the first place. Section 2 of the Act defines a processor as:

a person who processes personal data on behalf of the data controller in terms of sections 55 and 56.

The processor acts on the controller’s instructions. It does not decide the purpose of the processing, and it is not free to use the data for its own reasons. Sections 55 and 56 set out the framework for that arrangement, including what has to be in place before a controller hands personal data to a processor.

An example

A payroll company that runs monthly salary payments for a logistics business, using employee data the logistics business supplies, is a processor. The logistics business is the controller: it decided to collect the employee data and why it needs processing, to pay staff. The payroll company processes that data on the logistics business’s instructions, for the purpose the logistics business set, not a purpose of its own choosing.

Another example

A marketing agency that sends email campaigns to a retail business’s customer list, using content and targeting the retail business decides on, is a processor for that customer data. The retail business remains the controller: it built the list, and it decides who gets marketed to and with what message. The agency is carrying out the sending on the retail business’s instructions.

When a processor becomes a controller

Section 58 has an important twist. A processor that starts determining its own purposes and means for personal data, beyond what the controller instructed, becomes a controller for that data. Using the payroll example: if the payroll company decided, on its own initiative, to use employee salary data to build a product it sells to other businesses, it would no longer be acting purely as a processor for that use. It would be a controller for that new purpose, with a controller’s obligations attached to it.

The contract between controller and processor

Because a processor handles personal data without being the one accountable for the underlying decisions, the Act requires specific terms to be in place between a controller and its processors. What that contract actually needs to contain is covered on processor agreements.

Controller and processor together

A processor does not exist without a controller behind it. See data controllers for the paired concept, and what makes an organisation a controller rather than a processor in the first place.