Can you send personal data outside Botswana?

Yes, personal data can be sent outside Botswana, but only where the transfer fits one of the grounds Part XIV sets out: an adequacy decision, appropriate safeguards, approved binding corporate rules, or one of a short list of exceptions. A transfer that does not fit one of these is a contravention, and cross-border transfers are one of the categories that attracts the higher tier of administrative fine under section 83 (see penalties).

The basic rule, and the part everyone forgets (s.74)

Section 74 sets two conditions, not one. The first is the one most businesses expect: any transfer of personal data outside Botswana has to comply with this Part of the Act. The second is easy to miss, and it changes how you should think about “sending data abroad” in the first place: a copy of the transferred data has to remain in Botswana for the period during which it is processed.

In plain terms, moving data out does not mean the Botswana copy disappears. If your business transfers personal data to a processor or platform outside the country, section 74 expects a copy of that data to remain in Botswana for as long as the processing continues. That has real practical weight for any setup that is hosted purely offshore with no local copy at all, and it is worth checking specifically rather than assuming your existing arrangement already satisfies it.

Ground one: an adequacy decision (s.75)

The cleanest basis for a transfer is an adequacy decision. Under section 75, the Commission can assess a third country, a specific sector within it, or an international organisation, and form a view on whether it offers an adequate level of protection. That assessment looks at things like the country’s own data protection legislation, whether it has an independent supervisory authority, and its international commitments. If the assessment is positive, the Minister designates that country, sector or organisation as adequate by Order published in the Gazette. The designation is reviewed periodically, at least once every four years, and the Commission is required to publish the list of countries it currently treats as adequate.

As far as is known, no such list had been published as of the most recent available report on the Commission’s operations. That means no business should currently treat any specific country as pre-approved for transfers under section 75. If a list is published, watch the Government Gazette, or this guide, for the update.

Ground two: appropriate safeguards (s.76)

Without an adequacy decision, a transfer can still go ahead if it is covered by appropriate safeguards. Section 76 lists several:

• Legally binding instruments between public authorities.
• Binding corporate rules approved under section 77 (see below).
• Standard data protection clauses adopted by the Commission.
• An approved code of conduct that includes binding commitments on the receiving party.

Contractual clauses or administrative arrangements specifically between public authorities need separate authorisation from the Commission before they can be relied on. The other safeguards on this list do not carry that extra authorisation step.

Binding corporate rules, for group transfers (s.77)

Binding corporate rules are aimed at multinational groups moving personal data between entities in different countries. Section 77 does not let a company write its own internal policy and call it done. The rules have to cover specific content: the structure of the group and the transfers it covers, the data protection principles applied, the rights data subjects have and how they can enforce them, the duties of the data protection officer, complaint-handling procedures, audit mechanisms, reporting obligations to the Commission, and staff training. They also need the Commission’s approval before they can be used as a transfer ground.

When none of that applies: the narrow exceptions (s.78)

If a transfer has no adequacy decision, no safeguard, and no approved binding corporate rules behind it, section 78 provides a short list of derogations that can still justify it in a specific instance:

• The data subject has given explicit, informed consent to the transfer.
• The transfer is necessary to perform a contract with the data subject, or to implement pre-contractual measures at their request.
• The transfer is necessary for important reasons of public interest.
• The transfer is necessary to establish, exercise or defend a legal claim.
• The transfer is necessary to protect the vital interests of the data subject or another person who cannot give consent.
• The transfer is made from a register intended to provide information to the public, subject to the conditions attached to consulting that register.
• The transfer is necessary for the compelling legitimate interests of the controller, but only where those interests are not overridden by the data subject’s rights, and this ground is not available to a public authority acting in its official capacity.

These are meant to cover specific, occasional transfers, not to act as a standing basis for routine data flows. A business that regularly sends personal data abroad as part of its normal operations should be looking at sections 75 to 77, not relying on section 78 as its main ground.

A practical example: cloud email and accounting software

Most Botswana businesses run into Part XIV without realising it. A business using a cloud email platform or an accounting package hosted on servers outside Botswana is making an international transfer every time it processes a customer’s or employee’s personal data through that platform. That needs a ground under sections 75 to 78 to be lawful.

In practice, this is most realistically covered by the vendor’s own standard data protection clauses or compliance framework, a safeguard under section 76, rather than an adequacy decision that does not yet exist for most countries, or a derogation under section 78 that is not designed for routine, ongoing processing. Whichever ground applies, remember section 74’s second condition: a copy of that data still needs to be kept in Botswana for the period it is being processed, regardless of where the vendor’s servers sit.