Direct marketing rules under Botswana's Data Protection Act

There is no dedicated direct marketing law inside the Data Protection Act, 2024, and no separate registration or opt-in regime for marketing communications the way some other countries have. The only direct-marketing-specific provisions sit inside the general right to object, in section 48(3) to (5), and they are thinner than most business owners expect.

What section 48 actually says about marketing

Section 48(3) gives a data subject the right to object, at any time, to their personal data being processed for direct marketing, including any profiling connected to that marketing. Section 48(4) then removes the balancing test that applies to objections generally: once a data subject objects to processing for direct marketing purposes, that data may no longer be processed for that purpose.

That is an absolute stop, not a “we’ll consider it” standard. Under the general right to object in section 48(1) and (2), a controller can sometimes keep processing where it has compelling legitimate grounds that override the data subject’s interests. That override does not exist for direct marketing objections. Once someone objects to marketing, the processing for that purpose has to stop.

Section 48(5) adds a procedural requirement: this right has to be brought to the data subject’s attention explicitly and separately, at the time of the first communication with them. It cannot be buried in a general privacy notice or terms of service; it has to be called out on its own.

What this means for sending that first message

A business does not need a special “marketing consent” under a dedicated marketing law before sending someone a first marketing message. What it needs is an ordinary lawful basis under section 26 for processing that person’s data in the first place, most realistically consent or legitimate interests, depending on the relationship. If a customer bought something and gave a number for order updates, using that same lawful basis to also market to them is where legitimate interests gets tested; where there is no existing relationship at all, consent is the safer basis.

Where the Act does bite, specifically and without exception, is the moment someone says no. From then on:

• Marketing processing for that person has to stop, with no override available to the controller.
• The business needs to have told them, explicitly and separately at first contact, that this right exists in the first place.

Thinner than it looks

This is genuinely thinner than many business owners expect. There is no dedicated marketing Part, no registration requirement, no separate consent standard for SMS versus email versus WhatsApp, and no specific rule about marketing hours or message frequency. The Act regulates marketing only through the general lawful-basis rules that apply to any processing, plus this one absolute objection right. The practical mechanics of running compliant marketing on WhatsApp, email or SMS, deliverability, unsubscribe mechanics, list hygiene, are covered separately in the blog rather than in the Act itself, since the Act simply does not go into that level of detail.