Compliance Node Overview
Botswana's Data Protection Act No. 32 of 2018 (DPA) - assented to on 3 August 2018, published in the Botswana Government Gazette Extraordinary No. 64 of 3 August 2018, and brought into force through a Presidential Statutory Instrument - is Botswana's primary personal data protection legislation, establishing Botswana as one of the first Southern African countries to enact a comprehensive data protection law modelled on international standards. The supervisory authority is the Information and Data Protection Commission (the Commission), an independent public body established under the Act responsible for receiving notifications from data controllers, investigating complaints from data subjects, conducting audits, and enforcing the Act. Key features of Botswana's Data Protection Act No. 32 of 2018: (1) Scope - applies to data controllers who collect, process, store, or use personal data in Botswana; (2) Data processing principles - processing must comply with: lawfulness; purpose limitation; data minimisation (relevance and adequacy); accuracy; storage limitation; security; and accountability; (3) Sensitive personal data - the Act designates categories requiring enhanced protection: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health status; sexual orientation; genetic data; biometric data; and criminal record data; (4) Lawful processing conditions - consent; contractual necessity; legal obligation; vital interests; public interest; or legitimate interests; (5) Data subject rights - right of access; right to rectification; right to erasure; right to object to processing; right not to be subject to solely automated decisions; right to complain to the Commission; (6) Data controller notification - data controllers must notify the Commission before commencing processing of personal data; (7) Data Protection Officer - designated for data controllers engaged in large-scale systematic monitoring or large-scale processing of sensitive personal data; (8) Breach notification - data controllers must notify the Commission of personal data breaches likely to adversely affect the rights of data subjects; (9) Cross-border transfers - personal data may only be transferred to countries providing adequate protection or subject to Commission-approved safeguards; (10) Penalties - administrative fines and criminal penalties for contraventions of the Act. Botswana's Data Protection Act positions Botswana as a data-secure hub in Southern Africa, supporting the country's financial services, diamond industry, tourism, and emerging digital economy sectors.
Pillar: Cybersecurity · Authority: Information and Data Protection Commission (Botswana) · Version: 1.1.0 · Last updated:
Primary source: https://botswanalaws.com/consolidated-statutes/principle-legislation/data-protection
SHA-256 integrity: f704a183cb5fe2edff78c5634353fd9608e23803b1b115d08fd4833a1018e2a5
Primary Citations — 7 traced to source
- Data Protection Act No. 32 of 2018 (Botswana) - assented 3 August 2018; published Government Gazette Extraordinary No. 64; processing principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security, accountability; sensitive personal data: racial/ethnic origin, political opinions, religious beliefs, trade union membership, health, sexual orientation, genetic, biometric, criminal record; data subject rights: access, rectification, erasure, objection, automated decision-making protection; Commission notification mandatory; cross-border transfer restrictions; DPO for large-scale monitoring or sensitive data processing
- Information and Data Protection Commission (Botswana) - independent supervisory authority established under the Data Protection Act No. 32 of 2018; receives data controller notifications; investigates complaints from data subjects; conducts audits and inspections; issues enforcement orders; imposes administrative fines; approves cross-border transfer safeguards; publishes compliance guidance at gov.bw
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access