Credit Information Act, 2021: credit bureaus, licensing, consumer information and data subject rights

The Credit Information Act, 2021 provides that it comes into operation on a date the Minister appoints by Order published in the Gazette. The Non-Bank Financial Institutions Regulatory Authority informed non-bank lenders in a circular dated 5 June 2025 of the commencement of the Credit Information Act, 2021. The Bank of Botswana regulates and supervises credit information sharing in Botswana.

The Bank of Botswana announced on 27 June 2025 that it had issued credit bureau licences under section 8 of the Act. No person may establish, maintain or hold out as providing a credit bureau unless licensed under the Act. Operating a credit bureau without a licence is an offence carrying a fine not exceeding P250 000 or imprisonment for a term not exceeding five years, or both.

A credit bureau may not collect consumer information on a data subject unless the information is collected for a purpose directly related to an activity authorised under its licence. A credit bureau may not disclose consumer information to a person except in the cases section 21(1) lists. A credit bureau must put measures in place to protect consumer information from loss, misuse, unauthorised access, unauthorised disclosure, alteration, deletion or destruction.

A credit bureau must retain consumer information on a data subject for a period of at least 20 years. The 20-year period runs from final loan repayment, a write-off of the credit, a declaration of bankruptcy or discharge from bankruptcy. Consumer information may not be transferred to a third party in a foreign country unless the conditions in section 54(2) are met. One of those conditions is the data subject's written consent to the transfer.

A data subject has the right to receive a copy of all consumer information a credit bureau maintains on the data subject's own credit history, in the form of a credit report. A credit bureau must provide the credit report within seven days of receiving the data subject's request. A data subject may challenge a credit bureau, in writing, on the information in a credit report. A credit bureau may not report consumer information that is being challenged until the challenge has been resolved.

A data provider must provide consumer information to a credit bureau in the prescribed form. A data provider must give the data subject written notice before providing adverse consumer information to a credit bureau. The Bank of Botswana may impose administrative penalties on a person who, after due investigation, it is satisfied has committed an offence under the Act.