Processes personal data, in Botswana

Data Protection Act, 2024 (Act No. 18 of 2024), Part VIII (ss. 37-48) · Read the law's page

• Provide a data subject, on request, with confirmation of whether their personal data is being processed, and where it is, access to it and to information on the purpose of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making, including profiling.
• Act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.

Data Protection Act, 2024 (Act No. 18 of 2024), Part XIV (ss. 74-79) · Read the law's page

• Before transferring personal data to a third country or an international organisation, including an onward transfer, obtain an adequacy decision from the Commission, put in place appropriate safeguards or approved binding corporate rules, or rely on a listed derogation.
• Keep a copy of any personal data transferred to a third country or an international organisation in Botswana for the period of processing.

Data Protection Act, 2024 (Act No. 18 of 2024), Part XV (ss. 80-84) · Read the law's page

• Expect the Information and Data Protection Commission to investigate a data subject's complaint that your processing contravenes the Act, and to be able to impose an administrative fine for a contravention.
• Compensate a data subject who suffers material or non-material damage from your contravention of the Act.

Data Protection Act, 2024 (Act No. 18 of 2024), s. 29, Part VI (ss. 30-33) · Read the law's page

• Obtain consent given or authorised by a parent or a person with parental duties over a child under sixteen before processing that child's personal data for an information-society service offered directly to them; a child who is sixteen may consent themselves.
• Do not process racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health data, or data concerning sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
• Process personal data relating to a person's criminal convictions or offences only under the control of a public authority, or under a law that provides appropriate safeguards.

Data Protection Act, 2024 (Act No. 18 of 2024), ss. 1-5, 19-28, 51-62, 65-73 · Read the law's page

• Obtain a lawful basis before processing personal data of a person in Botswana, or of a person elsewhere if the processing is by a controller or processor established in Botswana.
• Process personal data lawfully, fairly and transparently, only for a specified and legitimate purpose, and collect no more than is adequate and relevant to that purpose.
• Be able to demonstrate that a data subject has consented to processing based on consent, and let the data subject withdraw that consent at any time.
• Implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.
• Carry out a data protection impact assessment before processing that is likely to result in a high risk to a natural person's rights and freedoms, and designate a data protection officer where your core activities require regular and systematic large-scale monitoring, or large-scale processing of sensitive personal data or of data relating to criminal convictions and offences.

Data Protection Act, 2024 (Act No. 18 of 2024), ss. 63-64 · Read the law's page

• Notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the affected person's rights and freedoms, and give reasons for any later notification.
• As a data processor, notify the data controller of a personal-data breach without undue delay after becoming aware of it.
• Communicate a high-risk personal-data breach to the affected data subject without undue delay.

Credit Information Act, 2021 (Act No. 17 of 2021), ss. 6, 20 to 23, 31, 35, 37, 54 and 56 · Read the law's page

• If you operate or hold yourself out as operating a credit bureau, hold a licence from the Bank of Botswana under the Credit Information Act, 2021.
• If you are a credit bureau, collect consumer information on a person only for a purpose directly related to an activity your licence authorises, and disclose it only in the cases the Act lists.
• If you are a credit bureau, protect consumer information from loss, misuse, unauthorised access, unauthorised disclosure, alteration, deletion or destruction, and keep it for at least 20 years from final loan repayment, a write-off, a declaration of bankruptcy or discharge from bankruptcy.
• If you are a credit bureau, give a person who asks a copy of the consumer information you hold on their own credit history as a credit report within seven days, let them challenge it in writing as inaccurate, incomplete or outdated, and do not report challenged information until the challenge is resolved.
• If you are a credit bureau, transfer consumer information to a third party in a foreign country only where the recipient is bound by a law, code or contract upholding international information protection principles and the person consents in writing.
• If you are a data provider, supply consumer information to a credit bureau in the prescribed form, and give the person written notice before you provide adverse information.