LexLint.ioBeta

Know the law your code answers to.

Law / Botswana

Data Protection Act, 2024, sensitive personal data and children's data

Data Protection Act, 2024 (Act No. 18 of 2024), s. 29, Part VI (ss. 30-33)

In force since .

A sensitive categories rule binding public and private bodies.

Obligation class
Consent, Biometric
Audit expectation
none

What it requires

  • Obtain consent given or authorised by a parent or a person with parental duties over a child under sixteen before processing that child's personal data for an information-society service offered directly to them; a child who is sixteen may consent themselves.
  • Do not process racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health data, or data concerning sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
  • Process personal data relating to a person's criminal convictions or offences only under the control of a public authority, or under a law that provides appropriate safeguards.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
FINOS AIGF

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Section 29 conditions a child's consent for information society services on a parent's consent, with reasonable efforts to verify it, and Part VI (ss. 30-33) prohibits processing of sensitive and criminal-offence data subject to exceptions. Section 29(2) asks for verification efforts but names no record of the verification, and no clause of the cited sections requires a log, register or record to be kept or produced. The cited sections state no territorial scope clause.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 29 makes processing of a child's personal data for an information-society service offered directly to them lawful only where a parent or a person with parental duties over the child has given or authorised consent, except that a child who is sixteen years of age may consent themselves.

Section 30(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and prohibits processing genetic data, biometric data used to uniquely identify a person, health data, or data concerning a person's sex life or sexual orientation, subject to the exceptions listed in section 30(2), including the data subject's explicit consent and data the data subject has manifestly made public.

Section 32 confines processing of personal data relating to criminal convictions and offences to control by a public authority, or to processing authorised by a law that provides appropriate safeguards.

When LexLint raises it

When your app profile says your app processes biometric data, serves under-18s or processes personal data.

Back to the example  ·  Lint your app

Page updated .