How long can a business keep personal data in Botswana?

No, the Data Protection Act, 2024 does not set a fixed retention period for any category of personal data, anywhere in the Act. What it sets instead is a principle: personal data must be kept for no longer than is necessary for the purpose it is being processed for. Working out what “necessary” means for your own business is left to you, not handed to you as a number.

The storage limitation principle (s.23)

Section 23 puts the rule directly:

Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.

That is a purpose test, not a clock. A business cannot pick an arbitrary number of years and call it compliant; the period has to be tied to why the data is being processed in the first place, and it stops being justifiable once that purpose has been served.

The archiving and research exception (s.35, s.62)

Section 35 allows personal data to be kept for longer than the ordinary storage-limitation rule would otherwise permit, where the purpose is archiving in the public interest, scientific or historical research, or statistical purposes. That exception is conditional, not automatic: it only applies where the security safeguards required under section 62 are actually in place. Longer retention for research or archiving does not excuse a business from protecting that data properly for as long as it is held.

You still have to disclose something (s.40(1)(a))

Even though the Act gives no fixed number, it does not let a business stay silent about retention either. Section 40(1)(a) requires a controller to tell the data subject, at the point of collection, either the actual storage period that will apply, or the criteria that will be used to work that period out. A privacy notice that says nothing at all about how long data will be kept does not meet this requirement, even where the business genuinely has not committed to a fixed number of years.

What this means in practice

A business has to do the work the Act does not do for it: set its own retention periods, based on a genuine, defensible link to the purpose the data was collected for, and document that reasoning so it can be produced if the Commission asks. “We might need it someday” does not satisfy section 23. Neither does keeping everything indefinitely because deleting things is inconvenient.

Some retention periods come from outside the Data Protection Act entirely. Tax and accounting legislation, for example, may independently require a business to keep financial records for a set number of years. That requirement exists because of that other law, not because the Data Protection Act specifies it, and it does not mean the Data Protection Act has a general retention rule of its own for anything else you hold.

If you see a source claiming the Data Protection Act sets a specific retention period, such as “personal data must be deleted after five years,” that claim is incorrect. The Act’s only rule is the purpose-based test in section 23, applied and justified case by case.