Data protection & privacy law in Botswana (2026)

The Minister for the State President issued Statutory Instrument SI 4/2025, commencing the Data Protection Act 2024 on 14 January 2025. The new Act replaces the entire 2018 framework, introduces GDPR-aligned principles (lawfulness, purpose limitation, data minimisation, accountability), 72-hour breach notification, fines up to BWP 50 million or 4% of global annual turnover, and extraterritorial scope covering controllers that monitor Botswana residents from abroad.

The Minister for State President published the Data Protection (Amendment) Act (Period of Processing Personal Data) Order in the Government Gazette, extending the compliance deadline for existing data processing operations from 17 September 2023 to 17 September 2024. The further extension reflected ongoing legislative reform work and insufficient Commission capacity, and coincided with drafting of the comprehensive 2024 Bill.

Parliament amended Section 54 of the 2018 Act, empowering the Minister to extend the transition period by 12 months to 15 September 2023. The amendment was driven by the newly-appointed Commissioner's public identification of serious legislative gaps, including no household-activity exemption and no rules for national-security processing, and the Commission still building its institutional capacity from scratch.

Kepaletswe Somolekae was appointed as Botswana's inaugural Information and Data Protection Commissioner, marking the Commission becoming operational. Somolekae promptly raised public alarms about gaps in the 2018 Act, including its silence on household-activity processing, national-security carve-outs, and international transfer adequacy rules, catalysing the legislative reform process that culminated in the 2024 Act.

The Minister of Presidential Affairs, Governance and Public Administration published the Commencement Order in the Government Gazette, activating the Data Protection Act 2018 three years after assent. Data controllers were granted a 12-month grace period (originally expiring 15 October 2022) to bring their processing operations into compliance, the first time personal data protection was enforceable in Botswana.

Botswana's first standalone data protection statute was passed in August 2018, establishing consent as the central lawful basis for processing, enumerating data subject rights (access, correction, deletion, objection), creating sensitive-data and direct-marketing restrictions, regulating cross-border transfers, and establishing the Information and Data Protection Commission as the supervisory authority. It was a landmark for the SADC region.

Parliament modernised the 2007 cybercrime law, providing precise definitions of cyber offences (unauthorised access, data interference, interception), stronger protections for critical computer systems, and updated rules for collecting electronic evidence. Directly relevant to data-breach liability and state access to personal data stored digitally.

Two complementary statutes established the legal recognition of electronic contracts and digital signatures (requiring BOCRA accreditation of e-signature providers) and the admissibility of electronic records in court proceedings. Together they laid the foundational digital-economy infrastructure on which subsequent data protection rules operate.

The CRA Act created the Botswana Communications Regulatory Authority as the unified regulator for telecommunications, internet, ICTs, broadcasting, and postal services. BOCRA was subsequently designated to administer the Data Protection Act on behalf of the Commission during the gap between the 2018 Act's assent and the Commission becoming operational in 2021-2022.

Botswana's first cybercrime statute criminalised unauthorised access to computer systems, interception of data in transit, and computer-related fraud, while facilitating collection of electronic evidence. It established state-level recognition that electronically stored data required legal protection, predating any dedicated privacy framework by more than a decade.

At independence, Section 9 of the Constitution prohibited the search of any person, their property, or entry onto their premises without consent, subject to defined exceptions. For over five decades this constitutional provision remained the sole privacy protection available in Botswana, providing the foundational human-rights basis on which the 2018 data-protection legislation was later built.