Understanding Botswana's Data Protection Act of 2024
In 2024, Botswana's Data Protection Act was updated. As a provider of cloud computing and web services, it is essential that we at Deltaworx understand this law. We provide services to developers and small businesses that store and handle client data, so it is important that both we and our clients understand it.
With that in mind, I set out to learn more. I downloaded a copy of the Act , it’s 48 pages long. If you want to read through it you can find it here. Like most legal documents, it feels as though you need a master’s degree in law and English just to understand it. After reading the first few pages, I quickly developed a headache from all the legal jargon.
Fortunately, it’s 2026, and we now have tools that can summarise lengthy legal documents into simple, plain English. So, I uploaded the document to Gemini, Claude, and ChatGPT and asked them to summarise the Data Protection Act. I wasn’t about to read through 48 pages of language I didn’t fully understand. The summary that follows is based on insights generated with the help of these large language models. If I have misunderstood anything, please let me know and I will update this post, you’ll find my contact details at the bottom. Let’s help each other better understand this law.
What is the Data Protection Act (in plain English)?
Botswana’s Data Protection Act is a law designed to protect people’s personal information and regulate how businesses collect, store, and use that data.
In simple terms:
If your business stores any customer data — names, emails, phone numbers, IDs, login details — this law applies to you.
It doesn’t matter if you're:
- A small business with a website
- A developer running a SaaS app
- A company hosting emails or databases
If you handle personal data, you're in scope.
What counts as “personal data”?
The Act defines personal data very broadly:
Any information that can identify a person directly or indirectly
This includes:
- Names and surnames, email addresses, phone numbers, ID numbers, IP addresses, location data, online user accounts
Even something like a customer database on your Website counts.
Who does the law apply to?
The Act applies to:
- Businesses operating in Botswana
- Businesses outside Botswana that serve Botswana customers
- Government institutions
- Anyone processing data using systems (manual or digital)
It even applies if your servers are located locally or internationally, as long as you process data related to people in Botswana.
The 6 core principles you must follow
This is the heart of the law. If you understand this, you understand 80% of compliance.
Your business must ensure data is:
1. Lawful, fair, and transparent
Don’t collect data secretly or misuse it.
2. Consent Requirement
Personal data must be collected with the individual’s consent, except in specific legal circumstance.
3. Minimal
Only collect what you actually need. Don’t ask for ID numbers if an email is enough.
4. Accurate
Keep data up to date.
5. Stored only as long as necessary
Don’t keep old customer data forever.
6. Secure
Protect it from hacks, leaks, and unauthorised access.
Your customers have rights
This is where things get serious.
Customers can:
- Ask what data you have about them, request corrections, request deletion (“right to be forgotten”), object to marketing, request their data in a transferable format.
If a customer emails you asking for their data, you are legally required to respond.
Does data have to stay in Botswana?
Short answer: No — the Act does not require data to be stored in Botswana, but it strictly regulates the transfer of personal data outside of the country.
Transfers outside of the country are prohibited unless:
1. The destination country is deemed "safe"
If the destination country has adequate data protection laws, then:
✔ You’re good to go
This is called an “adequacy decision” in the Act. After searching through the Act I couldn't find the list of countries deemed "safe" but I assume it includes South Africa, EU countries, USA and Canada.
2. If the country is NOT deemed safe
Then you must put safeguards in place, such as:
- Contracts between you and the foreign provider and Data protection clauses
The law focuses on how the data is protected rather than where it is physically located. You can store data outside of Botswana, but you must ensure the destination country is either officially recognised as "safe" or that you have a legal contract/framework in place to protect that data according to Botswana's standards.
Does my small business need a Data Protection Officer (DPO)?
Not necessarily. While public authorities must have a DPO, small businesses only need one if their "core activities" involve large-scale monitoring of people or processing very sensitive information (like health records). However, it is always a good idea to have one person in your team responsible for data safety.
What happens if you don’t comply?
The Act includes:
- Fines, legal liability and possible criminal penalties
The regulator (Information and Data Protection Commission) can:
- Investigate you, audit your systems, order you to stop processing data and issue penalties
Disclaimer: This blog post provides a general overview of the Data Protection Bill 2024 and does not constitute legal advice. If I have misunderstood the law or have left out important parts of the law then connect with me on Facebook @DeltaworxBW or send me an email [email protected] or send me a message on Whatsapp. I will update the post with the relevant bits of information.