Cybersecurity regulation in Botswana (2026)

Botswana's revised data protection law took effect, replacing the 2018 Act with GDPR-aligned obligations including extraterritorial scope, mandatory breach notification, explicit consent requirements, and stronger Data Protection Commission enforcement powers; data controllers were given a 12-month grace period for full compliance.

Botswana's first dedicated cybersecurity law establishes a National Cybersecurity Commission, mandates identification and protection of Critical National Information Infrastructure (CNII) across electricity, water, and healthcare sectors, and formalises the BWCIRT mandate. It introduces binding cybersecurity obligations on CNII operators and imposes penalties for cyber-extortion and creation of harmful fake social media profiles.

Three years after assent, the Data Protection Act 2018 formally came into force via the Data Protection Act (Commencement) Order 2021, obliging all data controllers and processors to implement security safeguards; a one-year grace period set full compliance as mandatory from 15 October 2022.

Botswana's first National Cybersecurity Strategy was approved and published, establishing objectives for a secure and resilient cyberspace, mandating a Critical National Information Infrastructure (CNII) risk assessment, directing creation of a national CIRT, and providing the policy foundation for the eventual Cybersecurity Act.

BOCRA established BwCIRT under the Ministry of Transport and Communications as Botswana's first official national CIRT, tasked with 24/7 monitoring of threats to critical information infrastructure, coordinating incident response, and acting as the national point-of-contact for international cybersecurity cooperation.

Botswana enacted its first standalone data protection law, requiring lawful processing of personal data, imposing security obligations on data controllers to prevent unauthorised access, and establishing the Data Protection Commission — filling a critical gap in the cybersecurity and privacy legal framework.

A comprehensive overhaul of the 2007 Act, enacted following a 2015 reform decision and Bill No. 33 of 2017, expanded criminal offences to cover unauthorised system access, data interception, identity theft, electronic fraud, and cyber-harassment, while strengthening Botswana's alignment with international cybercrime standards.

BOCRA issued implementing regulations under the 2014 Electronic Records Act designating itself as Certifying Authority, establishing the approved certification process for electronic record systems, and ensuring that certified electronic records produced from those systems are admissible as evidence in cybercrime prosecutions.

Botswana's foundational cybercrime law (Chapter 08:06) first criminalised unauthorised computer access, data interference, and computer-related fraud, establishing the baseline legal framework and jurisdictional rules that all subsequent cybersecurity legislation has built upon; it was repealed and replaced by the 2018 Act.