1.1 How Data Protection Works in Botswana (Start Here)

Every organisation collects information about people: customers, employees, job applicants, suppliers’ staff, website visitors and people caught on CCTV. Data protection law sets the rules for how that information may be collected, used, shared, kept and destroyed, and gives people rights over it.

This course is for everyone who handles personal data at work, and for suppliers that handle data for their clients, such as payroll bureaus, IT and cloud providers and call centres, because the law places duties on them too.

Why data protection law exists

Personal data is valuable. It lets a business serve customers, pay staff and plan. It is also a liability: when it is lost, stolen, misused or simply kept too long, real people can suffer fraud, discrimination, embarrassment or danger. The law lets organisations use personal data for legitimate purposes, provided they do so fairly, openly and securely, and can prove it.

The data lifecycle

Data protection applies at every stage of the information’s life:

1. Collect: decide what you need and tell people why you are collecting it.
2. Use: use it only for the purposes you stated, on a lawful basis.
3. Store: keep it accurate and secure.
4. Share: disclose it only where the law allows, with proper contracts in place.
5. Transfer: send it abroad only through an approved route.
6. Retain: keep it no longer than you need it.
7. Delete: destroy it securely when the retention period ends.

The main roles

The same organisation can be a controller for some data and a processor for other data. A payroll bureau, for example, is the controller of its own employees’ records and a processor of its clients’ payroll data (lesson 1.3).

The data protection laws

In Botswana the regulator is the Information and Data Protection Commission. It had no website of its own in 2025, so check the Government of Botswana portal, www.gov.bw.

How figures are used in this course

Fines, fees, response times and notification periods in the lessons are examples of the law as at 2026. They are not permanent rules: Botswana changes them through amending Acts, regulations, regulator guidance and court decisions. All the figures are gathered in a Course reference table at the end of lesson 5.4, dated so you can see how old they are.

Before you take a decision that depends on a figure or a deadline, confirm it through official channels.

Example: Headteacher Lorato Sebego mapped the personal data held by a Palapye private school with a parent app: parents’ contacts and fee records, pupils’ reports and medical notes, staff files and gate CCTV. For each she noted why it was collected, where it sat, who saw it, what went to the school’s payroll bureau and app developer, and when it would be destroyed. The map became the school’s first data inventory.

For controllers and processors

• If you are the controller: you are accountable for every stage of the lifecycle, including the stages your suppliers carry out for you.
• If you are a processor or supplier: you handle someone else’s data under their instructions, and the law gives you duties of your own.

Check before you act: Fines, fees and time limits here are 2026 examples, not fixed rules, and are expected to change. Confirm the current position with the Information and Data Protection Commission (through the Government of Botswana portal, www.gov.bw, until its own website is live), the Government Gazette or a qualified data protection or legal adviser.

Key takeaway

Data protection law lets organisations use personal data for legitimate purposes, provided they handle it fairly, openly and securely at every stage of its life and can prove they do. Controllers decide why and how data is used; processors act for them; the regulator enforces the rules.