Lawful bases for processing personal data in Botswana

Section 26 of the Data Protection Act, 2024 sets six lawful bases for processing personal data, and at least one of them has to apply before you process anyone’s personal data at all. Consent is one of the six. It is not the default, and it is not the only lawful way to process data, which is a common misconception among businesses in Botswana.

The six lawful bases (s.26)

• Consent - the data subject has given consent for a specific purpose. A gym asking members to opt in to marketing SMS messages relies on this basis, and only for that specific purpose.
• Contract - processing is necessary to perform a contract with the data subject, or to take steps at their request before entering into one. A delivery company processing a customer’s address to fulfil an order relies on this basis, not consent, because delivering what was paid for is part of the contract itself.
• Legal obligation - processing is necessary to comply with a legal obligation the controller is subject to. An employer processing salary data to meet its tax withholding obligations relies on this basis.
• Vital interests - processing is necessary to protect the vital interests of the data subject or of another natural person. A clinic sharing a patient’s emergency contact details with paramedics during a medical emergency relies on this basis.
• Public interest or official authority - processing is necessary for performing a task carried out in the public interest, or in the exercise of official authority vested in the controller. This mainly covers government bodies and entities carrying out public functions.
• Legitimate interests - processing is necessary for the legitimate interests of the controller or a third party, unless those interests are overridden by the data subject’s own rights and freedoms, especially where the data subject is a child. A retail shop keeping basic fraud-prevention logs on suspicious transactions can generally rely on this basis, but a business cannot lean on legitimate interests as easily where the person involved is a child. See children’s data for why.

Consent is one option, not the default

Businesses often assume they need a signed consent form before they can process any personal data. Section 26 does not work that way. A delivery company does not need a customer’s consent to process their address for a delivery they ordered and paid for, because the contract basis already covers it. Reaching for consent when another basis already applies just adds paperwork, and it creates a real problem later: consent can be withdrawn at any time under section 28, so relying on it for processing you actually need to continue (like keeping records for a legal obligation) is the wrong choice from the start.

Sensitive personal data has its own rules

The six bases above apply to ordinary personal data. Sensitive personal data, health, biometric and similarly sensitive categories, needs a lawful ground under section 30 instead, which is a separate and stricter list with its own conditions. That is covered in full on the sensitive data processing page, not here.