BotswanaCybersecurity Act, Reporting of Cybersecurity Incidents
Cybersecurity Act, 2025 (Act No. 21 of 2025), s. 53
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This Act is not yet in force: it comes into operation on the date the Minister appoints by Order published in the Gazette (section 1), and an owner is bound only from that date.
- This binds the owner of critical information or critical national information infrastructure that the National Cybersecurity Authority has designated by Notice in the Gazette, public or private (reached by declaring that you operate an essential service).
- Immediately notify the Botswana Computer Security Incident Response Team, in the manner it determines, of a perceived or actual cybersecurity incident in respect of the critical information or critical national information infrastructure, or in respect of any computer system under your control that is interconnected or communicates with it (section 53(1)).
- Submit a preliminary cybersecurity incident report to the Team immediately after the incident is detected and within not more than eight hours of notifying it, in the manner and form prescribed (section 53(2)).
- Submit a detailed cybersecurity incident report to the Team as soon as the incident is resolved (section 53(3)).
- Establish mechanisms and processes, in accordance with the cybersecurity standards prescribed, to detect a cybersecurity threat in respect of the critical information or critical national information infrastructure (section 53(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
An owner that is a natural person and contravenes section 53 commits an offence liable to a fine not exceeding P100 000, imprisonment for a term not exceeding two years, or both (section 53(5)).
Penalty structure
Applies to an owner that is a company, as an administrative penalty payable to the Authority; an owner that is a natural person instead faces a fine not exceeding P100 000, imprisonment for a term not exceeding two years, or both.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The National Cybersecurity Authority.
Settledness
- As of
- Open questions
- On what date will the Minister appoint the Act to come into operation, and in what manner and form must the preliminary report be made under section 53(2)?
What this law does
Section 53(1) of the Act requires an owner of critical information or critical national information infrastructure to notify the Botswana Computer Security Incident Response Team immediately of a perceived or actual cybersecurity incident in respect of that information or infrastructure.
Section 53(1)(b) of the Act extends the notice to a cybersecurity incident in respect of any computer, computer system or information system under the owner's control that is interconnected or communicates with critical information or critical national information infrastructure.
Section 53(2) of the Act requires an owner to submit a preliminary cybersecurity incident report to the Botswana Computer Security Incident Response Team immediately after the incident is detected and within not more than eight hours of notifying the Team of the incident. Section 53(3) of the Act requires an owner to submit a detailed cybersecurity incident report to the Botswana Computer Security Incident Response Team as soon as the incident is resolved.
Section 53(5) of the Act makes an owner that is a company liable to an administrative penalty not exceeding 10 per cent of its annual turnover, and an owner that is a natural person liable to a fine not exceeding P100 000, to imprisonment for a term not exceeding two years, or to both.
When LexLint raises it
When your app profile says your app runs an essential service.