The data protection principles under Botswana's DPA

Part IV of the Data Protection Act, 2024 sets out seven principles that apply to every piece of personal data a business in Botswana handles, from a customer’s phone number in a spreadsheet to a job applicant’s ID copy. Sections 19 to 25 each cover one principle, and all seven apply together, not as alternatives.

Lawfulness, fairness and transparency (s.19)

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”

In practice, this means three things at once: you need an actual legal reason to process someone’s data (see lawful processing for the six options), you cannot use data in a way that would unfairly surprise or disadvantage the person it belongs to, and you need to tell people what you are doing with their data rather than process it quietly in the background.

Purpose limitation (s.20)

Personal data must be collected for a specified, explicit and legitimate purpose, and not processed further in a way that is incompatible with that purpose. A retail shop that collects a customer’s phone number to send delivery updates cannot start using the same number for unrelated marketing texts without a proper basis for that new purpose. Section 35 carves out an exception: personal data can be kept and processed beyond its original purpose for archiving in the public interest, scientific or historical research, or statistical purposes, provided the safeguards in section 62 are in place.

Data minimisation (s.21)

Personal data must be adequate, relevant and limited to what is necessary for the purpose it was collected for. A school enrolling a pupil needs a parent’s contact details and the child’s date of birth; it has no reason to ask for the parent’s employer or bank details.

Accuracy (s.22)

Personal data must be accurate and, where necessary, kept up to date, and inaccurate data must be erased or rectified without delay. A logistics company that keeps sending parcels to a customer’s old address because nobody updated the record is falling short of this principle, not just being slow.

Storage limitation (s.23)

Personal data must be kept in a form that identifies the data subject for no longer than is necessary for the purposes it was processed for. Section 23 is the only place in the Act that deals with retention, and it does not set fixed retention periods for anything: there is no rule anywhere in the Act saying data must be kept for a specific number of years. Section 35 allows longer storage for archiving, research or statistical purposes, subject to the section 62 safeguards. Working out how long is “necessary” for your own business is a separate question, covered in full on the data retention page.

Integrity and confidentiality (s.24)

Personal data must be processed with appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures. Section 62 sets out what those measures need to look like in more detail; see data security for that.

Accountability (s.25)

“A data controller shall be responsible for, and be able to demonstrate, compliance with sections 19 to 24.”

This is the principle that turns the other six from good intentions into something you can be checked on. It is not enough to actually be lawful, minimal, accurate and secure: a controller has to be able to show it. That means keeping records of what data is held and why, evidence of the security measures that are actually in place, and proof that decisions about purpose and retention were made deliberately, not assumed. A business that cannot produce anything when asked how it complies with sections 19 to 24 has an accountability gap even if its underlying practices happen to be fine. See records of processing for what that evidence should look like in practice.