Does a foreign business need a representative in Botswana?

If a foreign business is caught by the Data Protection Act’s extraterritorial scope at all, then yes, section 54 generally requires it to designate a representative established in Botswana, in writing. The exceptions are narrow, and most businesses actively targeting the Botswana market will not qualify for them.

Who this section applies to

Section 54 only comes into play for a controller or processor that is not established in Botswana but is caught by the extraterritorial scope set out in section 4(2), meaning it offers goods or services to data subjects in Botswana, or monitors their behaviour. That threshold question, whether a foreign business is caught by the Act at all, is covered in full on who does it apply to. Section 54 assumes that question has already been answered “yes” and deals with what follows: designating someone local to represent the business.

The exemptions

Section 54 does not require a representative in two situations:

• where the processing is occasional, small-scale, does not involve sensitive personal data, and is unlikely to result in a risk to the rights of data subjects, or
• where the entity carrying out the processing is a public authority.

These exemptions are narrow. A foreign business running an ongoing commercial operation aimed at Botswana customers, rather than an isolated or incidental transaction, will generally not qualify for the “occasional, small-scale” exemption.

Who this affects in practice

Two kinds of businesses come up most often:

• An e-commerce site based outside Botswana that specifically targets and ships to Botswana customers. If it markets to Botswana, prices in pula, or otherwise directs its offering at people here, it is offering goods or services to data subjects in Botswana under section 4(2), and the processing is unlikely to be occasional if it is running an active online store.
• A foreign SaaS company with a Botswana customer base that actively monitors usage. Tracking how Botswana-based users behave inside a product, through analytics, usage logs, or similar monitoring, falls within the “monitoring” limb of section 4(2), which brings the representative requirement into play regardless of where the company is incorporated or hosted.

A foreign business that occasionally receives an order from a Botswana customer without targeting the market, or that processes no sensitive data and presents no meaningful risk, sits closer to the exemption, but this is a narrower category than many businesses assume.

Why this matters beyond paperwork

A designated representative gives the Commission and Botswana data subjects a real point of contact inside the country, rather than requiring them to pursue a business with no local presence. For a foreign controller weighing whether it is worth the administrative step, the more useful question is usually the earlier one: is it caught by the Act’s extraterritorial scope in the first place. If the answer is yes and none of the narrow exemptions apply, a written designation under section 54 follows as a matter of course, alongside the other obligations that come with being a controller or processor under Botswana law.