Data protection & privacy law in Botswana (2026)

Legal framework

Data Protection Act 18 of 2024 (in force 14 January 2025), supervised by the Information and Data Protection Commission (IDPC)

Key points: data & privacy in Botswana

1. 01Governing Legislation

   Data Protection Act 18 of 2024 repealed the 2018 Act and came into force on 14 January 2025. It is the primary comprehensive statute governing personal data processing in Botswana, modelled broadly on GDPR-style principles including lawfulness, fairness, purpose limitation, data minimisation, accuracy, storage limitation, and the new additions of accountability, integrity, and confidentiality.

   botswanalaws.com bocra.org.bw

2. 02Supervisory Authority

   The Information and Data Protection Commission (IDPC) is the independent national supervisory authority. It is divided into a Data Protection Division and an Access to Information Division. The Commission handles complaints, investigations, enforcement, and public awareness. The inaugural Commissioner is Ms. Kepaletswe Somolekae.

   dailynews.gov.bw dlapiperdataprotection.com

3. 03Individual Rights

   Data subjects are granted rights to access, correct, delete, and restrict processing of their personal data. They may also request data portability and object to automated decision-making, bringing the regime broadly in line with GDPR-equivalent protections.

   techhiveadvisory.africa cipit.strathmore.edu

4. 04Controller & Processor Obligations

   Data controllers must conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, appoint a Data Protection Officer under prescribed conditions, and notify the IDPC within 72 hours of discovering a personal data breach. The Act also introduces specific rules on processing children's data.

   itlawco.com techhiveadvisory.africa

5. 05Cross-Border Data Transfers

   The 2024 Act introduces a soft data localisation requirement: a copy of personal data transferred abroad must be retained in Botswana during the processing period. Transfers are only permitted to countries deemed to have adequate protections; Botswana has published a list of 45 approved destination countries including Kenya and South Africa.

   techhiveadvisory.africa cipit.strathmore.edu

6. 06Penalties

   Maximum administrative fines were raised from BWP 10 million under the 2018 Act to BWP 50 million (approximately USD 3.7 million) or 4% of global annual turnover under the 2024 Act. Criminal liability, including imprisonment, applies for breaches of confidentiality and unauthorised data use.

   itlawco.com dlapiperdataprotection.com

Timeline of decisions

1. 14 Jan 2025Decision
   Data Protection Act 2024 Enters into Force via SI 4/2025

   The Minister for the State President issued Statutory Instrument SI 4/2025, commencing the Data Protection Act 2024 on 14 January 2025. The new Act replaces the entire 2018 framework, introduces GDPR-aligned principles (lawfulness, purpose limitation, data minimisation, accountability), 72-hour breach notification, fines up to BWP 50 million or 4% of global annual turnover, and extraterritorial scope covering controllers that monitor Botswana residents from abroad.

   Botswana Laws — Official Gazette Bulletin

2. 15 Sept 2023Decision
   Second Compliance Deadline Extension, Period of Processing Personal Data Order 2023

   The Minister for State President published the Data Protection (Amendment) Act (Period of Processing Personal Data) Order in the Government Gazette, extending the compliance deadline for existing data processing operations from 17 September 2023 to 17 September 2024. The further extension reflected ongoing legislative reform work and insufficient Commission capacity, and coincided with drafting of the comprehensive 2024 Bill.

   Minchin & Kelly (Botswana) — law firm analysis

3. 16 Sept 2022Law
   Data Protection (Amendment) Act 33 of 2022, First Compliance Extension

   Parliament amended Section 54 of the 2018 Act, empowering the Minister to extend the transition period by 12 months to 15 September 2023. The amendment was driven by the newly-appointed Commissioner's public identification of serious legislative gaps, including no household-activity exemption and no rules for national-security processing, and the Commission still building its institutional capacity from scratch.

   Botswana Laws — Official Gazette Bulletin

4. 1 Mar 2022Decision
   First Information and Data Protection Commissioner Appointed

   Kepaletswe Somolekae was appointed as Botswana's inaugural Information and Data Protection Commissioner, marking the Commission becoming operational. Somolekae promptly raised public alarms about gaps in the 2018 Act, including its silence on household-activity processing, national-security carve-outs, and international transfer adequacy rules, catalysing the legislative reform process that culminated in the 2024 Act.

   ITWeb Africa

5. 15 Oct 2021Decision · official
   Data Protection Act 2018 Brought into Force, S.I. No. 86 of 2021

   The Minister of Presidential Affairs, Governance and Public Administration published the Commencement Order in the Government Gazette, activating the Data Protection Act 2018 three years after assent. Data controllers were granted a 12-month grace period (originally expiring 15 October 2022) to bring their processing operations into compliance, the first time personal data protection was enforceable in Botswana.

   Botswana Communications Regulatory Authority (BOCRA)

6. 1 Aug 2018Law · official
   Data Protection Act 2018 (Act 32 of 2018) Enacted

   Botswana's first standalone data protection statute was passed in August 2018, establishing consent as the central lawful basis for processing, enumerating data subject rights (access, correction, deletion, objection), creating sensitive-data and direct-marketing restrictions, regulating cross-border transfers, and establishing the Information and Data Protection Commission as the supervisory authority. It was a landmark for the SADC region.

   Botswana Communications Regulatory Authority (BOCRA) — Official Act text

7. 30 Sept 1966Law · official
   Constitution of Botswana, Section 9: Protection for Privacy of Home and Property

   At independence, Section 9 of the Constitution prohibited the search of any person, their property, or entry onto their premises without consent, subject to defined exceptions. For over five decades this constitutional provision remained the sole privacy protection available in Botswana, providing the foundational human-rights basis on which the 2018 data-protection legislation was later built.

   Parliament of Botswana — Official Constitutional Text

Sources

1. 1.botswanalaws.com/bulletin/principal-legislation/bulletin-2024/act-18-of-2024---data-pr
2. 2.bocra.org.bw/data-protection-act
3. 3.dailynews.gov.bw/news-detail/65941
4. 4.techhiveadvisory.africa/insights/understanding-botswanas-new-data-protection-act-key-updates-
5. 5.itlawco.com/focus-areas/data-protection-and-privacy/data-protection-act-18-of-202
6. 6.cipit.strathmore.edu/understanding-botswanas-2018-and-2024-data-protection-acts/
7. 7.dlapiperdataprotection.com/index.html?t=law&c=BW
8. 8.dlapiperdataprotection.com/index.html?t=authority&c=BW