BotswanaData Protection Act, 2024, transfer of personal data to third countries or international organisations
Data Protection Act, 2024 (Act No. 18 of 2024), Part XIV (ss. 74-79)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Before transferring personal data to a third country or an international organisation, including an onward transfer, obtain an adequacy decision from the Commission, put in place appropriate safeguards or approved binding corporate rules, or rely on a listed derogation.NIST Privacy FrameworkCT.PO-P2
- Keep a copy of any personal data transferred to a third country or an international organisation in Botswana for the period of processing.NIST Privacy FrameworkID.IM-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Where a transfer to a third country rests on a derogation, section 78(4) requires the controller or processor to document the assessment and the appropriate safeguards in its records. The Act's printed text points those records at section 62, although the record of processing activities is section 60; the quoted words are as published. The clause names no log contents, no retention period and no person who may demand the record. Under section 77(1), binding corporate rules must include verification mechanisms, with data protection audits, whose results are communicated to the data protection officer and the controlling undertaking's board and are available to the Commission on request; that is an audit by the group itself, and it applies only to transfers made under binding corporate rules. Section 74 sets a duty on a controller or processor in Botswana and the Part states no separate scope clause.
- Kind
- Explicit
- As of
- Provision
- Section 78(4)
- Trigger
- personal_data_processing
What this law does
Section 74 requires any transfer of personal data from a data controller or data processor in Botswana to a data controller, data processor or other recipient in a third country or an international organisation, including an onward transfer, to be carried out under Part XIV, and additionally requires a copy of the transferred personal data to remain in Botswana for the period of processing.
Sections 75 to 78 permit a transfer where the Commission has made an adequacy decision, appropriate safeguards such as standard contractual clauses are in place, approved binding corporate rules apply, or a listed derogation applies.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .