What counts as personal data under Botswana's Data Protection Act?

Personal data is any piece of information that relates to a specific person, or that can be used, on its own or together with other information, to work out who that person is. A name is personal data. So is a phone number, a delivery address, or an Omang number. Section 2 of the Act sets out the definition:

“any information relating to an identified or identifiable natural person, or data subject; and an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

What this looks like for a Botswana business

Most of what a business collects about customers, staff and suppliers falls under this definition. A few concrete examples:

• A customer’s name, phone number or delivery address on an online store’s order system.
• An employee’s Omang number, kept on file for payroll.
• A car registration plate, once it is linked to the name of the person who owns or drives the vehicle.
• A photo of a person, whether taken for a staff ID card or captured on CCTV.
• An IP address or device ID, where a business can tie that identifier back to a specific customer or user account.

The common thread is the link to a specific, identifiable person. A delivery address only becomes personal data because it is tied to whoever lives there or ordered the delivery, not because addresses are sensitive in themselves.

Direct and indirect identification

The definition covers a person who can be identified “directly or indirectly.” Direct identification is straightforward: a name on an invoice identifies the customer directly. Indirect identification is what catches businesses out. A delivery driver who only ever sees a house number and a first name on a parcel may not know who the customer is, but if that information can be matched, by the business, to a full customer record, it is still personal data. The test is whether the person can be identified, on the information available, not whether every individual employee handling it happens to recognise them.

It only covers natural persons

The definition is about natural persons, meaning individual human beings, not companies, trusts or other legal entities. A business’s company registration number, VAT number or trading name is not personal data by itself. The personal data only comes in once you are dealing with information about the people connected to that business: a director’s name, an employee’s ID number, a sole proprietor’s home address.

Where sensitive personal data fits in

Not all personal data is treated the same way. A narrower category, sensitive personal data, covers things like health information, biometric data and religious belief, and carries extra restrictions on top of the general rules that apply to personal data as a whole. If what your business handles falls into one of those categories, start there rather than treating it as ordinary personal data.