Can you process sensitive personal data in Botswana?

Processing sensitive personal data in Botswana is prohibited by default. Section 30(1) of the Data Protection Act, 2024 sets that prohibition, and section 30(2) then lists ten specific conditions that lift it. If none of the ten applies, you cannot process the data, no matter how useful it would be to your business. For what actually counts as sensitive personal data in the first place, see the sensitive personal data page; this page covers the rules once you already know you are dealing with it.

The default is prohibition (s.30(1))

Unlike ordinary personal data, where you simply need one of the six lawful bases in section 26, sensitive personal data starts from a flat “no” and needs one of the conditions below to say otherwise.

The ten conditions that lift the prohibition (s.30(2))

Explicit consent has been given for a specified purpose, unless another law prohibits processing that category of data even with consent.
Processing is necessary to carry out obligations or exercise rights under employment or social protection law.
Processing is necessary to protect the vital interests of the data subject, where they are physically or legally incapable of giving consent.
The processing relates to personal data that the data subject has manifestly made public themselves.
Processing is necessary for the establishment, exercise or defence of legal claims, or when courts are acting in their judicial capacity.
Processing is necessary for reasons of substantial public interest, and is proportionate to the aim pursued.
Processing is necessary for healthcare or occupational medicine purposes, carried out by a professional bound by a duty of confidentiality.
Processing is necessary for reasons of public health.
Processing is necessary for archiving, research or statistical purposes, subject to appropriate safeguards.
The processing relates to elections or political party membership data, under conditions prescribed by law.

Example: a clinic and patient health data

A clinic that keeps patient health records is processing sensitive personal data, but it is not relying on patient consent for every routine entry. It relies on the healthcare condition: processing carried out for healthcare purposes by a professional under a duty of confidentiality. That condition exists precisely so that ordinary clinical work does not grind to a halt waiting on a fresh consent form for every interaction.

Section 31 covers processing of sensitive personal data by specific categories of entities, and section 32 covers data relating to criminal convictions and offences as its own category. Both sit alongside section 30 rather than inside it, and neither is covered in depth here.

Educational information only, not legal advice. Source: Data Protection Act, 2024 (Act No. 18 of 2024), s.30, s.31, s.32. Last reviewed: 7 September 2026.

Frequently asked questions

That is a separate question covered on the sensitive personal data page. This page is about the rules for processing it once you know it is sensitive, not the definition of the category itself.

Consent is one of the ten conditions in section 30(2), so yes, consent can be the basis. But a clinic processing patient health records more commonly relies on the healthcare condition instead, since that condition is built for exactly that situation and does not depend on the patient re-consenting for routine care.

They are related but covered separately. Section 32 deals with data on criminal convictions and offences as its own category, distinct from the sensitive personal data conditions in section 30.