When is a data protection impact assessment required in Botswana?

A data protection impact assessment, or DPIA, is required before a business starts processing that is likely to result in a high risk to people’s rights and freedoms. Sections 65 to 68 of the Data Protection Act, 2024 set out when one is needed, what it has to contain, and what happens when the risk cannot be brought down far enough.

When a DPIA is required (s.65(1))

Section 65(1) sets the general test: a DPIA is required before carrying out processing that, particularly where new technologies are used, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons. This is a forward-looking assessment. It has to happen before the processing starts, not as a review after it is already running.

The three situations that always require one (s.65(3))

Section 65(3) removes the guesswork for three specific categories of processing, each of which requires a DPIA on its own:

• a systematic and extensive evaluation of personal aspects through automated processing, including profiling, which produces legal effects concerning a person or similarly significantly affects them,
• large-scale processing of sensitive personal data, or of data relating to criminal convictions and offences, and
• systematic monitoring of a publicly accessible area on a large scale.

The Commission’s own lists (s.66)

Section 66 requires the Commission to establish and publish lists of processing operations that do and do not require a DPIA. Once those lists exist, they give businesses a more concrete reference point than applying the general “likely to result in a high risk” test from scratch each time.

What a DPIA has to contain (s.67)

Section 67 requires a DPIA to contain:

• a description of the processing operations and their purposes,
• an assessment of the necessity and proportionality of the processing,
• an assessment of the risks to data subjects, and
• the measures planned to address those risks and demonstrate compliance.

The controller may seek the views of data subjects on the processing where appropriate, and a DPIA already covered by an existing general legal impact assessment does not need to be repeated separately.

Prior consultation with the Commission (s.68)

Where a DPIA shows that a high risk would remain even after the controller’s planned mitigation measures, section 68 requires the controller to consult the Commission before starting to process the data. The Commission must respond with written advice within 8 weeks of the request, and that period can be extended by a further 6 weeks for complex cases, provided the controller is told of the extension and the reasons for it within the first month.

A practical example

A business planning to roll out large-scale CCTV with facial recognition across a public shopping area needs a DPIA before switching the system on, because it falls squarely within the “systematic monitoring of a publicly accessible area on a large scale” category in section 65(3). If the assessment shows a real risk remains, for instance around how long footage and biometric matches are kept and who can access them, even after the business has put its planned safeguards in place, it needs to consult the Commission under section 68 before going live, not after. Whether this kind of processing also triggers a mandatory data protection officer is a related question worth checking at the same time.