Data processing agreement requirements under Botswana's DPA

Sections 55 to 59 of the Data Protection Act, 2024 govern the relationship between a controller and any processor it uses. The short version: a processor has to be chosen carefully, bound by a written contract with specific mandatory content, and cannot bring in help of its own without permission.

Choosing a processor (s.55)

A controller may only use a processor that provides sufficient guarantees to implement appropriate technical and organisational measures, in a way that meets the Act’s requirements and protects the rights of data subjects. This is a due diligence obligation sitting before the contract itself: a controller cannot simply sign an agreement with any processor and assume the paperwork covers the risk. The processor’s actual capability to protect the data matters.

What the contract has to cover (s.56 and s.58)

Section 58 requires the relationship to be governed by a contract or other legal act, in writing, including electronic form. Section 56 sets out what it has to contain:

• the subject matter and duration of the processing,
• the nature and purpose of the processing,
• the type of personal data involved and the categories of data subjects,
• the obligations and rights of the controller, and
• specific obligations placed on the processor.

Those processor obligations include:

• processing personal data only on the controller’s documented instructions,
• ensuring confidentiality,
• implementing appropriate security measures,
• assisting the controller in responding to data subject requests and breach notifications,
• deleting or returning personal data at the end of the engagement, and
• making available to the controller the information needed to demonstrate compliance.

A general service contract that covers price, deliverables and service levels but says nothing about these points does not meet section 56, even if the underlying commercial relationship is perfectly normal.

Sub-processors (ss.55(2) to (3) and 57)

A processor cannot engage a sub-processor of its own without the controller’s prior written authorisation. Where a sub-processor is engaged, the original processor remains fully liable for that sub-processor’s failures under section 57. A controller cannot be presented with a sub-contracting arrangement after the fact and be expected to accept it, and a processor cannot use a sub-processor’s mistake as a reason to disclaim its own responsibility.

Standard contractual clauses (s.59)

Section 59 allows the Commission to issue standard contractual clauses that businesses can use to meet these requirements, rather than drafting bespoke wording from scratch each time. Where the Commission has published such clauses, adopting them is a practical way to satisfy section 56 without a lengthy negotiation over contract terms.

A practical example

A business that outsources its payroll processing, or hands its email marketing list to a third-party platform, is using a processor under the Act. The contract with that payroll company or marketing platform needs to cover the section 56 content: what data is being processed, for how long, what the processor will and will not do with it, and what happens to the data when the relationship ends. A standard commercial services agreement that does not address these points leaves both the controller and the processor exposed, regardless of how good the underlying service is. See data controllers and data processors if it is not yet clear which role your business is playing in a given relationship.