BotswanaCybersecurity Act, Critical National Information Infrastructure Regime
Cybersecurity Act, 2025 (Act No. 21 of 2025), ss. 45-52
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Licensing
As of .
What it requires
- This Act is not yet in force: it comes into operation on the date the Minister appoints by Order published in the Gazette (section 1), and an owner is bound only from that date.
- This binds the owner of information or information infrastructure that the National Cybersecurity Authority designates by Notice in the Gazette as critical information or critical national information infrastructure in a critical sector, public or private (reached by declaring that you operate an essential service).
- Comply with the baseline security requirements prescribed for the designated critical information or critical national information infrastructure (section 45(3)).
- Apply for the licence the Act requires of an information or information infrastructure designated as critical, in the form and manner prescribed (section 45(2)).
- Register the critical information or critical national information infrastructure with the Authority within 14 days of the designation (section 47(1)).
- Host critical information or critical national information infrastructure within Botswana unless the Authority authorises hosting outside Botswana (section 49).
- Seek the Authority's approval of any change of ownership within seven days of the change (section 50(1)).
- Remedy within the period the Authority states in writing any non-compliance that an audit under section 51 finds (section 52).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
An owner that is a natural person and fails to register designated infrastructure with the Authority within 14 days commits an offence liable to a fine not exceeding P100 000, imprisonment for a term not exceeding two years, or both (section 47(2)).
Penalty structure
Applies to an owner that is a company, as an administrative penalty payable to the Authority; an owner that is a natural person instead faces a fine not exceeding P100 000, imprisonment for a term not exceeding two years, or both.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The National Cybersecurity Authority.
Settledness
- As of
- Open questions
- On what date will the Minister appoint the Act to come into operation, and which information infrastructure will the Authority designate under section 45(1)?
What this law does
Section 45(1) of the Act has the National Cybersecurity Authority designate, by Notice in the Gazette, an information or information infrastructure relevant to a critical sector as a critical information or critical national information infrastructure. Section 2 of the Act includes among the critical sectors telecommunications and IT systems, transport, energy, water, the financial sector, healthcare, and public and e-government services.
Section 45(3) of the Act requires the owner of a designated information or information infrastructure to comply with such baseline security requirements as may be prescribed. Section 47(1) of the Act requires the owner to register the critical information or critical national information infrastructure with the Authority within 14 days of the designation.
Section 49(1) of the Act requires an owner to host critical information or critical national information infrastructure within Botswana, and section 49(2) lets the Authority authorise hosting outside Botswana. Section 50(1) of the Act requires an owner to seek the approval of the Authority of any change of ownership within seven days of the change.
Section 51(1) of the Act has the Authority carry out a periodic audit and inspection on critical information and critical national information infrastructure to ensure compliance with the Act. Section 47(2) of the Act makes an owner that is a company liable to an administrative penalty not exceeding 10 per cent of its annual turnover, and an owner that is a natural person liable to a fine not exceeding P100 000, to imprisonment for a term not exceeding two years, or to both.
When LexLint raises it
When your app profile says your app runs an essential service.