Record of processing activities: what Botswana's DPA requires

Section 60 of the Data Protection Act, 2024 requires a controller or processor to maintain a written record of processing activities, made available to the Commission on request. Most businesses that process personal data on an ongoing basis need one, even if they employ fewer than 250 people, because the small-enterprise exemption is narrower than it first appears.

What a controller’s record has to contain

A controller’s record of processing activities has to set out:

• the name and contact details of the controller, and of any joint controller, representative or data protection officer,
• the purposes of the processing,
• a description of the categories of data subjects and the categories of personal data,
• the categories of recipients the data has been or will be disclosed to, including recipients in third countries,
• details of any international transfers of the data,
• the envisaged time limits for erasure of the different categories of data, and
• a general description of the technical and organisational security measures in place, where possible.

What a processor’s record has to contain

A processor keeps a similar record, covering the categories of processing it carries out on behalf of each controller it works with, rather than the fuller set of detail a controller has to record.

The exemption for smaller enterprises

An enterprise employing fewer than 250 people does not have to keep this record, unless one of three things is true:

• the processing is likely to result in a risk to the rights and freedoms of data subjects,
• the processing is not occasional, or
• the processing includes sensitive personal data or data relating to criminal convictions.

Any one of these takes the exemption away. This is where the exemption is narrower than it looks on first read. A small employer running ordinary staff payroll might assume that, with a handful of employees, section 60 does not apply. But payroll processing runs continuously for as long as someone is employed, which is not what the Act means by “occasional.” Most ongoing business processing, an active customer database, a running payroll, a subscription list that gets used every month, fails the “occasional” test and falls back into the record-keeping requirement regardless of headcount.

A clearer way to test it: ask whether the processing is a one-off or intermittent event, or whether it is a standing feature of how the business runs. A retail shop’s loyalty programme, a clinic’s patient list, and a payroll system are all standing features, not occasional processing, so the fewer-than-250-employees exemption will not help most of them even though they qualify on size alone.

Why this record matters beyond the exemption question

A record of processing activities is also the practical foundation for several other obligations. It is hard to notify a breach accurately, assess security measures, or demonstrate the accountability required by the data protection principles without already knowing what personal data is held, where it came from, and where it goes. Building this record is usually the first concrete step a business should take when putting its overall compliance in order.