What is a data protection officer under Botswana's Data Protection Act?

A business only has to appoint a data protection officer if it falls into one of three specific categories set out in section 69(1) of the Data Protection Act, 2024. Outside those three, appointing one is a choice, not a requirement. Sections 69 to 73 cover when the appointment is mandatory, who can fill the role, and what protections and duties come with it.

The three cases where a DPO is mandatory (s.69(1))

Section 69(1) requires a controller or processor to designate a data protection officer where:

• the processing is carried out by a public authority or body, except for courts acting in their judicial capacity,
• the core activities of the controller or processor consist of processing operations which, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale, or
• the core activities of the controller or processor consist of large-scale processing of sensitive personal data, or of data relating to criminal convictions and offences under section 32.

The word “core” matters here. It is about what the business’s central activity actually is, not about whether it happens to hold some sensitive data somewhere in its records.

When it is optional (s.69(2))

Outside those three cases, appointing a data protection officer is optional. A group of controllers or processors may appoint a single shared officer, which is useful for related companies or franchise groups that want one point of accountability across several entities. If a controller chooses to publicise its data protection officer’s contact details even without being required to appoint one, it must inform the Commission in writing that it has done so.

Who can be the DPO, and how they’re appointed (s.69, s.70)

Section 70 requires the data protection officer to be designated on the basis of professional qualities, expert knowledge of data protection law and practice, and a proven ability to carry out the duties set out in section 72. They can be an existing staff member taking on the role or someone engaged under a separate service contract. Once someone is designated, section 69(3) requires the controller or processor to submit that person’s name and contact details to the Commission, in whatever manner the Commission prescribes.

Protecting the DPO’s independence (s.71)

Section 71 requires the position to have:

• independence in how the role is carried out,
• involvement in all data-protection-related issues in a timely way,
• adequate resources to do the job,
• protection from being dismissed or penalised for performing DPO duties,
• direct reporting to the highest level of management, and
• confidentiality in carrying out the role.

These protections exist because a data protection officer who can be sidelined, under-resourced or quietly removed for raising uncomfortable findings is not really functioning as one.

What the DPO actually does (s.72)

Section 72 sets out the officer’s core duties: informing and advising the controller or processor of its obligations under the Act, monitoring compliance including staff training and audits, advising on data protection impact assessments and monitoring how they are carried out, and acting as the contact point for the Commission, including for the prior consultations required under section 68.

Codes of conduct (s.73)

Section 73 provides for codes of conduct in relation to the data protection officer role, giving the Commission a mechanism to set out more detailed expectations for how the position should operate in practice, beyond the baseline set out in sections 69 to 72.

A practical test

A mid-sized retail chain processing ordinary customer and staff data, loyalty programme details, payroll, the usual run of a retail business, generally does not meet any of the three mandatory triggers in section 69(1), even though nothing stops it appointing a DPO voluntarily. A private health clinic processing patient records at scale, on the other hand, is squarely within the “large-scale processing of sensitive personal data” trigger, and a company running large-scale CCTV monitoring of a public area falls within the “regular and systematic monitoring… on a large scale” trigger. Both of those need a data protection officer as a matter of law, not choice.