Who does the Data Protection Act apply to?

If your business processes personal data in Botswana, by computer or as part of a manual filing system, the Data Protection Act, 2024 applies to you. It makes no difference whether you are a single-branch shop or a listed company: the test is what you do with the information, not your size. The Act also reaches beyond Botswana’s borders in specific circumstances, so a business with no local office can still be caught by it.

Processing inside Botswana

Section 4(1) covers the processing of personal data wholly or partly by automated means, and non-automated processing that forms part of a filing system. In practice, that covers almost every Botswana business that keeps records on customers, staff or suppliers. A retail shop in Gaborone with a customer database on a laptop is processing personal data by automated means. A clinic with a paper-based patient filing cabinet is processing personal data too, because it is the filing system the Act is concerned with, not the medium it is stored on.

Reaching outside Botswana

Section 4(2) extends the Act to a controller or processor not established in Botswana, where the processing relates to offering goods or services to data subjects in Botswana, or to monitoring the behaviour of data subjects in Botswana. This is the Act’s extraterritorial reach: a business does not need a Botswana address, staff or bank account to fall under it.

The difference shows up clearly with two similar-looking businesses. A Gaborone retail shop that keeps a customer database is covered under section 4(1), because it is processing personal data in Botswana. An online store based in South Africa that specifically targets Botswana customers, prices in Pula, and ships to Botswana addresses is offering goods to data subjects in Botswana, and section 4(2) brings it under the Act too, even though it has no presence here.

The State is covered too

Section 5 states that the Act binds the State. Government ministries, local authorities and parastatals process personal data under the same Act as private businesses, not under a separate set of rules.

If a foreign business is caught by section 4(2)

A controller or processor that falls under the Act through section 4(2), without being established in Botswana, may need to appoint a local representative under section 54. That requirement, and what the representative actually has to do, is covered in full on local representatives. This page is only about establishing whether the Act applies to you in the first place.

What this means for a small business

Most Botswana businesses fall under the Act simply by keeping records on customers or staff, whether on a computer or on paper. The extraterritorial provisions in section 4(2) matter mainly if your business sells specifically into Botswana from outside it, or if you are dealing with a foreign supplier that does the same to you. Either way, the question to ask is not where a business is registered, but whose personal data it is processing, and how.