BotswanaData Protection Act, 2024, personal data breach notification
Data Protection Act, 2024 (Act No. 18 of 2024), ss. 63-64
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the affected person's rights and freedoms, and give reasons for any later notification.
- As a data processor, notify the data controller of a personal-data breach without undue delay after becoming aware of it.
- Communicate a high-risk personal-data breach to the affected data subject without undue delay.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 63(6) requires the controller to document every personal data breach, with the facts, its effects and the remedial action taken, whether or not it was notified, and section 63(7) requires that documentation to be provided in such manner as to enable the Commission to verify compliance, as the Commission may determine. The printed text of subsection (7) refers to 'subsection (5)'; the documentation duty is subsection (6). The facts, effects and remedial action are not log fields. Sections 63 and 64 set no retention period for the documentation and state no territorial scope clause.
- Kind
- Explicit
- As of
- Provision
- Section 63(6)-(7)
- Trigger
- security_incident
What this law does
Section 63(1) requires a data controller to notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject, and section 63(2) requires reasons for any later notification.
Section 63(3) requires a data processor to notify the data controller of a personal-data breach without undue delay after becoming aware of it. Section 64(1) requires the data controller to communicate a personal-data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to that person's rights and freedoms.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .