BotswanaData Protection Act, 2024, compensation, administrative fines and offences
Data Protection Act, 2024 (Act No. 18 of 2024), Part XV (ss. 80-84)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Expect the Information and Data Protection Commission to investigate a data subject's complaint that your processing contravenes the Act, and to be able to impose an administrative fine for a contravention.
- Compensate a data subject who suffers material or non-material damage from your contravention of the Act.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 84 creates criminal offences on top of the administrative-fine and compensation regime: a data controller who does not implement the security safeguards required under Part XI is liable to a fine of P500,000 or imprisonment for up to nine years, or both; a person who sells personal data commits the same offence at the same penalty; and a person who contravenes any other provision of the Act, where no other penalty is provided, is liable to a fine not exceeding P500,000 or imprisonment for a term not exceeding nine years, or both.
Penalty structure
Section 83(3) sets the higher administrative-fine tier: up to P50,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for a contravention of the core processing principles and consent conditions (Parts IV to VI), data-subject rights (Part VIII), cross-border transfer rules (Part XIV), obligations under a restricting law (Part VII), or an order of the Commission. Section 83(2) sets a narrower lower tier, up to P10,000,000 or 2 percent of worldwide annual turnover, whichever is higher, for a contravention of the children's-consent duty (section 29) or the data-protection-by-design and by-default duty (section 52) specifically. Separately, section 84's criminal offences (failing to implement required security safeguards, selling personal data, or any other contravention with no other penalty provided) carry a fine of up to P500,000 alongside imprisonment of up to nine years; neither criminal track exceeds the P50,000,000 fixed cap.
- Rule
- Higher of
- As of
- Currency
- BWP
- Fixed cap
- 50,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information and Data Protection Commission
Settledness
- As of
- Open questions
- Does a contravention of section 29 (consent to a child's data in relation to information society services), which lies in Part V, attract the administrative fine of up to P10 000 000 or two per cent of worldwide annual turnover in section 83(2), or the fine of up to P50 000 000 or four per cent in section 83(3)(a), which reaches "the basic principles for processing, including conditions for consent, under Parts IV to VI"?
What it makes you log
Logging duty
Part XV (ss. 80-84) gives a complaint right, a right to compensation, administrative fines and offences. It names no log, register or record to be kept or produced. The Commission's powers to demand information and run data protection audits sit in sections 14 to 16, which this row does not cite, and are not borrowed. The cited Part states no territorial scope clause.
- Kind
- None
- As of
What this law does
A data subject may lodge a complaint with the Information and Data Protection Commission if they consider that processing of their personal data contravenes the Act, and the Commission must inform the complainant of the progress and outcome of the complaint. A person who suffers material or non-material damage from a contravention of the Act is entitled to compensation from the data controller or data processor.
The Commission may impose an administrative fine of up to P50,000,000, or four percent of an undertaking's total worldwide annual turnover of the preceding financial year, whichever is higher, for a contravention of the processing principles and consent conditions, data-subject rights, cross-border transfer rules, an obligation under a restricting law, or a Commission order, and a lower fine of up to P10,000,000, or two percent of worldwide annual turnover, whichever is higher, for a contravention of the children's-consent duty or the data-protection-by-design duty specifically.
A person who fails to implement required security safeguards, who sells personal data, or who otherwise contravenes the Act where no other penalty is specified, commits an offence carrying a fine of up to P500,000 or imprisonment of up to nine years, or both.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .