Online safety & content laws in Botswana (2026)

Act 18 of 2024 came into full effect, replacing the 2018 Act with GDPR-aligned accountability principles, mandatory data-breach notifications, children's data safeguards requiring age-verification, binding obligations on the State and foreign controllers processing Botswana residents' data, and penalties up to BWP 50 million or 4% of global annual turnover.

Botswana's first standalone cybersecurity statute established formal governance structures including protection of critical information infrastructure (electricity, water, healthcare), mandated capacity-building, regulated cybersecurity activities, and strengthened the mandate of the national Computer Security Incident Response team. It moves national cyber-resilience policy beyond crime-specific provisions into whole-of-government governance.

The President assented to Act 18 of 2024 on 24 October; it was published in the Official Gazette on 29 October 2024. The Act repealed and re-enacted the 2018 statute with significant additions: Data Protection Impact Assessments for high-risk processing, explicit data-minimisation and storage-limitation duties, and extraterritorial reach over foreign processors.

Parliament enacted Botswana's first comprehensive data protection statute, establishing consent-based processing rules, data-subject rights, restrictions on sensitive data and direct marketing, cross-border transfer controls, and a Data Protection Commission, implementing the constitutional right to privacy in the digital context.

Act 18 of 2018 repealed and replaced the 2007 cybercrime law with modernised offences covering unauthorised access, computer fraud, online child exploitation, and cyberstalking; it raised minimum fines for attacks on protected computers to BWP 40,000-100,000 and introduced updated electronic-evidence collection provisions.

BOCRA, acting as the Certifying Authority under the 2014 Act, issued regulations establishing the approved process for certifying electronic records systems; only records certified under this process are presumed authentic in legal proceedings, directly supporting prosecution of cybercrime.

The Botswana Communications Regulatory Authority became operational under the CRA Act 2012, consolidating oversight of telecommunications, internet, broadcasting, and postal services under a single independent authority, and assuming management of the .bw ccTLD, creating the unified regulatory body for all online-safety and ICT compliance.

The CRA Act replaced separate broadcasting and telecommunications statutes with a unified legislative framework, establishing BOCRA with an explicit mandate to regulate internet and ICTs, protect consumers, and develop the internet market, the statutory foundation for all subsequent online-safety regulation.

Botswana's first national ICT policy, 'Maitlamo' (meaning commitment), was approved by Parliament, providing the strategic roadmap for digital development, internet school connectivity, and explicitly identifying the need for enabling cybercrime, data protection, and electronic-transactions legislation; it set the legislative agenda fulfilled over the following decade.

Botswana's foundational cyber law created offences for unauthorised computer access, computer fraud, and data interference, and established extraterritorial jurisdiction for cybercrimes affecting Botswana; it was the country's first statute directly targeting online criminal conduct.