Botswana

Section 63(1) requires a data controller to notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject, and section 63(2) requires reasons for any later notification.

Section 63(3) requires a data processor to notify the data controller of a personal-data breach without undue delay after becoming aware of it. Section 64(1) requires the data controller to communicate a personal-data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to that person's rights and freedoms.

The Data Protection Act, 2024 (Act No. 18 of 2024) applies to automated and non-automated processing of personal data by a controller or processor established in Botswana, and reaches a foreign controller or processor that offers goods or services to people in Botswana or monitors their behaviour there; it binds the State and excludes only purely personal or household processing and specified state functions.

A controller or processor must process personal data lawfully, fairly and transparently, only for a specified and legitimate purpose, and must collect no more than is adequate and relevant to that purpose. Where processing is based on consent, the controller must be able to demonstrate that the data subject consented, and a data subject may withdraw consent at any time.

A controller and processor must implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.

A controller must carry out a data protection impact assessment before processing that is likely to result in a high risk to a natural person's rights and freedoms, and a controller or processor must designate a data protection officer where its core activities require regular and systematic large-scale monitoring, or large-scale processing of sensitive personal data or of data relating to criminal convictions and offences.

Section 74 requires any transfer of personal data from a data controller or data processor in Botswana to a data controller, data processor or other recipient in a third country or an international organisation, including an onward transfer, to be carried out under Part XIV, and additionally requires a copy of the transferred personal data to remain in Botswana for the period of processing.

Sections 75 to 78 permit a transfer where the Commission has made an adequacy decision, appropriate safeguards such as standard contractual clauses are in place, approved binding corporate rules apply, or a listed derogation applies.

Section 49 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them. The right does not apply where the decision is necessary for entering into or performing a contract, is based on the data subject's explicit consent, or is authorized by a law.

Where the decision rests on the contract or consent exception, the data controller must implement suitable safeguards, including letting the data subject obtain human intervention, express their point of view, and contest the decision.

A data subject has the right to obtain confirmation of whether their personal data is being processed and, where it is, access to it together with information on the purpose of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making, including profiling.

A data controller must act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and must inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.

A data subject may lodge a complaint with the Information and Data Protection Commission if they consider that processing of their personal data contravenes the Act, and the Commission must inform the complainant of the progress and outcome of the complaint. A person who suffers material or non-material damage from a contravention of the Act is entitled to compensation from the data controller or data processor.

The Commission may impose an administrative fine of up to P50,000,000, or four percent of an undertaking's total worldwide annual turnover of the preceding financial year, whichever is higher, for a contravention of the processing principles and consent conditions, data-subject rights, cross-border transfer rules, an obligation under a restricting law, or a Commission order, and a lower fine of up to P10,000,000, or two percent of worldwide annual turnover, whichever is higher, for a contravention of the children's-consent duty or the data-protection-by-design duty specifically.

A person who fails to implement required security safeguards, who sells personal data, or who otherwise contravenes the Act where no other penalty is specified, commits an offence carrying a fine of up to P500,000 or imprisonment of up to nine years, or both.

Section 29 makes processing of a child's personal data for an information-society service offered directly to them lawful only where a parent or a person with parental duties over the child has given or authorised consent, except that a child who is sixteen years of age may consent themselves.

Section 30(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and prohibits processing genetic data, biometric data used to uniquely identify a person, health data, or data concerning a person's sex life or sexual orientation, subject to the exceptions listed in section 30(2), including the data subject's explicit consent and data the data subject has manifestly made public.

Section 32 confines processing of personal data relating to criminal convictions and offences to control by a public authority, or to processing authorised by a law that provides appropriate safeguards.

Botswana's primary computer-misuse statute, assented to on 29 June 2018, repealing and re-enacting with amendments an earlier Act of the same short title. It came into force on 4 July 2018 by Statutory Instrument 83 of 2018.

The current consolidated Laws of Botswana list a Chapter 08:06 "Cybercrime and Computer Related Crimes" whose section numbering and section headings match this 2018 Act exactly (unauthorised access as section 4, unauthorised interference with data as section 7, and so on), which this Act's own repeal clause explains: it is the current occupant of a chapter number the prior Act held.

It criminalizes unauthorised access to a computer or computer system (section 4, a fine up to P20,000 or imprisonment up to one year, or both) and to a computer service (section 5, up to P40,000 or two years), access with intent to commit a further offence (section 6), unauthorised interference with data or with a computer system (sections 7 and 8), unlawful interception (section 9), possession of hacking devices or data (section 10), unauthorised disclosure of a password or access code (section 11), introducing a computer contaminant (section 12), unauthorised access to critical national infrastructure (section 13), cyber extortion and cyber fraud (sections 14 and 15), cyber harassment and stalking (sections 16 to 18), child pornography and grooming offences (section 19), revenge pornography (section 20), and racist or xenophobic material (sections 21 and 22).

The highest penalty in the Part on offences is a minimum fine of P1,000,000 rising to P5,000,000 for a service provider that unlawfully discloses that a preservation, production, or surveillance order has been made against it, or discloses data collected under such an order (section 23); the Act carries no general liability exemption for a search engine, indexer, or host.

Part III gives police and other authorised officers powers to order data preservation, disclosure, production, search and seizure, and real-time collection of traffic or content data, each generally requiring judicial authorisation.

Botswana's Copyright and Neighbouring Rights Act, 2000 (Cap. 68:02, Act No. 8 of 2000, commenced by S.I. 65 of 2001, and as amended by Act No. 6 of 2006, commenced by S.I. 71 of 2006) defines "literary work" to include "a table of compilation", so a database that is an intellectual creation through the selection, coordination, or arrangement of its contents is protected as a literary work; there is no separate sui generis database right.

The Act's private-reproduction exception, which otherwise permits a single personal copy of a published work, expressly does not extend to reproduction of the whole or a substantial part of a database (section 13(2)(c)), so reproducing a substantial part of a protected database without authorisation is not shielded by that exception. The underlying facts and data within a database remain unprotected; only the selection or arrangement is a protected work.

Criminal sanctions apply to a person who infringes a protected right for profit (section 31(1), a fine up to P20,000 or imprisonment up to ten years, or both, for a first offence, rising to a minimum fine of P30,000 and a maximum of P5,000,000, or imprisonment up to ten years, or both, for a second or subsequent offence), and civil remedies include injunctions, damages, and exemplary damages for an infringement prejudicial to honour or reputation (section 30).

The Act provides that it comes into operation on such day as the Minister appoints by order made by statutory instrument, and the day on which the provisions this row describes came into operation has not been located.

Section 45(1) of the Act has the National Cybersecurity Authority designate, by Notice in the Gazette, an information or information infrastructure relevant to a critical sector as a critical information or critical national information infrastructure. Section 2 of the Act includes among the critical sectors telecommunications and IT systems, transport, energy, water, the financial sector, healthcare, and public and e-government services.

Section 45(3) of the Act requires the owner of a designated information or information infrastructure to comply with such baseline security requirements as may be prescribed. Section 47(1) of the Act requires the owner to register the critical information or critical national information infrastructure with the Authority within 14 days of the designation.

Section 49(1) of the Act requires an owner to host critical information or critical national information infrastructure within Botswana, and section 49(2) lets the Authority authorise hosting outside Botswana. Section 50(1) of the Act requires an owner to seek the approval of the Authority of any change of ownership within seven days of the change.

Section 51(1) of the Act has the Authority carry out a periodic audit and inspection on critical information and critical national information infrastructure to ensure compliance with the Act. Section 47(2) of the Act makes an owner that is a company liable to an administrative penalty not exceeding 10 per cent of its annual turnover, and an owner that is a natural person liable to a fine not exceeding P100 000, to imprisonment for a term not exceeding two years, or to both.

Section 53(1) of the Act requires an owner of critical information or critical national information infrastructure to notify the Botswana Computer Security Incident Response Team immediately of a perceived or actual cybersecurity incident in respect of that information or infrastructure.

Section 53(1)(b) of the Act extends the notice to a cybersecurity incident in respect of any computer, computer system or information system under the owner's control that is interconnected or communicates with critical information or critical national information infrastructure.

Section 53(2) of the Act requires an owner to submit a preliminary cybersecurity incident report to the Botswana Computer Security Incident Response Team immediately after the incident is detected and within not more than eight hours of notifying the Team of the incident. Section 53(3) of the Act requires an owner to submit a detailed cybersecurity incident report to the Botswana Computer Security Incident Response Team as soon as the incident is resolved.

Section 53(5) of the Act makes an owner that is a company liable to an administrative penalty not exceeding 10 per cent of its annual turnover, and an owner that is a natural person liable to a fine not exceeding P100 000, to imprisonment for a term not exceeding two years, or to both.

The Copyright and Neighbouring Rights Act, 2000 (Cap. 68:02, Act No. 8 of 2000, commenced by S.I. 65 of 2001, and as amended by Act No. 6 of 2006, commenced by S.I. 71 of 2006) permits, without the author's authorisation but subject to naming the author and source, the reproduction in a newspaper or periodical, or the broadcasting or other communication to the public, of an article on current economic, political, or religious topics published in a newspaper or periodical, or a broadcast work of the same character, unless the right to authorise that reproduction has been expressly reserved by the author or owner of copyright (section 18(a)).

It separately permits reproducing and broadcasting or communicating short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by the purpose (section 18(b)), and reproducing in a newspaper or periodical, or broadcasting, a political speech, lecture, address, sermon, or similar work delivered in public, or a speech delivered during legal proceedings, to the extent justified for providing current information (section 18(c)).

A separate quotation right permits reproducing a short part of a published work in the form of quotation, compatible with fair practice and not exceeding the extent justified by the purpose, with source and author named (section 14). Neighbouring rights under Part IV protect only performers, producers of sound recordings, and broadcasting organisations, so a print or online news publisher holds no neighbouring right distinct from its ordinary copyright in the articles it publishes.

The Act provides that it comes into operation on such day as the Minister appoints by order made by statutory instrument, and the day on which the provisions this row describes came into operation has not been located.