What is sensitive personal data under Botswana's Data Protection Act?

Sensitive personal data is a narrower category inside personal data generally, covering the kinds of information about a person that carry a higher risk if mishandled: things like health, religion, or biometric details. Botswana’s Act places extra restrictions on processing anything in this category, on top of the general rules that apply to personal data as a whole.

Section 2 defines sensitive personal data as:

personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; the processing of genetic data; biometric data for the purpose of uniquely identifying a natural person; data concerning health; or data concerning a natural person’s sex life or sexual orientation.

The definition goes further than that list. It also extends to data revealing the commission or alleged commission of an offence, data on proceedings for an offence, including how it was disposed of or the sentence handed down, and personal data of a minor, which carries its own conditions under section 30.

Why this category exists

Health records, biometric data, and details of someone’s religion or political views can be used to discriminate against, embarrass or expose a person in ways an ordinary name or phone number cannot. That is why this category carries extra conditions before it can be processed at all, set out in full on sensitive data processing. This page is only about what falls into the category, not what a business has to do to process it lawfully.

What isn’t sensitive personal data

Most of what a typical business holds on customers and staff doesn’t fall into this category. A customer’s name and phone number on a general mailing list is personal data, but not sensitive personal data, on its own. It only tips into the sensitive category once it starts revealing one of the specific things listed above, for example if that same mailing list were built by identifying customers of a particular religious organisation, which would reveal something about religious belief.

What this looks like for a Botswana business

• A clinic or hospital’s patient health records are sensitive personal data by default, because they concern health.
• An HR file that notes an employee’s religion, kept so the business can plan around religious holidays or prayer times, is sensitive personal data.
• A biometric time-clock system, where staff clock in with a fingerprint or facial scan, processes biometric data used to uniquely identify each employee.
• CCTV footage used for facial recognition, rather than plain footage of people moving through a space, becomes sensitive personal data once it is used to identify someone from their face.

Children’s data

Personal data belonging to a minor sits inside this same sensitive category, with its own conditions under section 30. That is covered in full on children’s data.