What is the Data Protection Act, 2024?

Botswana has had a data protection law on the books since 2018, but that law never built up much of a track record before it was replaced. The Data Protection Act, 2024 (Act No. 18 of 2024) is the version that actually governs personal data in Botswana today, and it has done since 14 January 2025.

If your business collects names, phone numbers, ID numbers, photos, or anything else that identifies a person, this Act applies to how you handle that information from the moment you collect it to the moment you delete it.

Where it came from

The Act was passed by the National Assembly on 19 August 2024, assented to on 24 October 2024, and published in the Government Gazette Extraordinary on 29 October 2024. Its own commencement clause left the start date open:

This Act may be cited as the Data Protection Act, 2024 and shall come into operation on such date as the Minister may, by Order published in the Gazette, appoint.

That order came a few months later. The Data Protection Act (Date of Commencement) Order, 2025 (Statutory Instrument No. 4 of 2025), published on 13 January 2025, fixed the start date as 14 January 2025. That is the date the Act, and every obligation in it, became enforceable.

Section 100 repeals the previous Data Protection Act, 2018 (Cap. 43:14) outright. Section 101 carries over anything already in motion under the old Act: pending investigations, appeals, subsidiary legislation, and the Commission’s existing staff and structures all continue under the new one rather than starting from zero.

What the Act is actually for

The Act’s own enacting formula sets out its purpose in one sentence:

An Act to make provision for the continuation of the Information and Data Protection Commission; to regulate the protection of personal data and to ensure that the privacy of individuals in relation to their personal data is maintained; and to provide for all matters incidental thereto.

Three things follow from that. First, it keeps the regulator that already existed under the 2018 Act running rather than creating a new one from scratch. Second, its main job is regulating how personal data gets processed, not just protecting privacy in the abstract. Third, it covers “all matters incidental thereto,” which is why the Act runs to 101 sections rather than a short set of principles.

How the Act is organised

The Act is split into 17 parts. Knowing the shape of it makes the rest of this guide easier to follow:

• Part I sets out definitions, who the Act applies to, and its objects.
• Parts II and III cover the Information and Data Protection Commission: its structure and its powers.
• Parts IV to VII set the ground rules for processing personal data: the core principles, the lawful grounds for processing, extra rules for sensitive data, and a few specific situations like archiving and research.
• Part VIII lists the rights a data subject actually has, from access to objection.
• Parts X to XIII cover what controllers and processors have to do: security, impact assessments, and data protection officers.
• Part XIV covers sending personal data outside Botswana.
• Part XV sets out compensation, administrative fines, and criminal offences.
• Part XVI covers the appeals process.

Each of those areas gets its own page in this guide, because trying to explain all 101 sections on one page would make none of it usable. Start with who the Act applies to if you are trying to work out whether it affects your business, or go straight to personal data if you want to know what counts as the thing being protected.