BotswanaData Protection Act, 2024 (Act No. 18 of 2024)
Data Protection Act, 2024 (Act No. 18 of 2024), ss. 1-5, 19-28, 51-62, 65-73
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Governance, DPIA, Security
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Obtain a lawful basis before processing personal data of a person in Botswana, or of a person elsewhere if the processing is by a controller or processor established in Botswana.NIST Privacy FrameworkCT.PO-P1
- Process personal data lawfully, fairly and transparently, only for a specified and legitimate purpose, and collect no more than is adequate and relevant to that purpose.NIST Privacy FrameworkGV.PO-P1
- Be able to demonstrate that a data subject has consented to processing based on consent, and let the data subject withdraw that consent at any time.NIST Privacy FrameworkCT.PO-P1
- Implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P2
- Carry out a data protection impact assessment before processing that is likely to result in a high risk to a natural person's rights and freedoms, and designate a data protection officer where your core activities require regular and systematic large-scale monitoring, or large-scale processing of sensitive personal data or of data relating to criminal convictions and offences.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does section 26 (f) of the Data Protection Act, 2024, which makes processing lawful where it is "necessary for the purposes of the legitimate interests pursued by the data controller or by a third party", cover collecting personal data from public web pages without the data subject's consent?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 60 requires each controller, and each processor for the processing it carries out for a controller, to maintain a written record of processing activities and to make it available to the Commission on request. Subsection (4) exempts an organisation of fewer than 250 persons unless its processing is likely to risk data subjects' rights, is not occasional, or includes sensitive or criminal-offence data. The record's contents (names, purposes, categories of data subjects and data, recipients, transfers, envisaged erasure time limits, security measures) are not log fields. Section 27(1) separately requires a controller relying on consent to demonstrate that the data subject consented, and section 25 requires it to be able to demonstrate compliance with sections 19 to 24; neither names a record. The Act sets no period for keeping the register.
- Kind
- Explicit
- As of
- Provision
- Section 60(1)-(5)
- Trigger
- personal_data_processing
What this law does
The Data Protection Act, 2024 (Act No. 18 of 2024) applies to automated and non-automated processing of personal data by a controller or processor established in Botswana, and reaches a foreign controller or processor that offers goods or services to people in Botswana or monitors their behaviour there; it binds the State and excludes only purely personal or household processing and specified state functions.
A controller or processor must process personal data lawfully, fairly and transparently, only for a specified and legitimate purpose, and must collect no more than is adequate and relevant to that purpose. Where processing is based on consent, the controller must be able to demonstrate that the data subject consented, and a data subject may withdraw consent at any time.
A controller and processor must implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.
A controller must carry out a data protection impact assessment before processing that is likely to result in a high risk to a natural person's rights and freedoms, and a controller or processor must designate a data protection officer where its core activities require regular and systematic large-scale monitoring, or large-scale processing of sensitive personal data or of data relating to criminal convictions and offences.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .