Navigating the Shifting Sands of Privacy

In an era defined by data-driven economies, the importance of robust data protection frameworks cannot be overstated. Botswana, along with many African nations, is actively reshaping its regulatory landscape to align with international best practices, safeguard individual privacy rights, and foster trust in the digital economy. At Minchin & Kelly, we provide authoritative legal guidance to help your business navigate these evolving data protection regulations across Botswana and the African continent, ensuring compliance while capitalizing on digital opportunities.

Botswana has recently enacted the Data Protection Act No.18 of 2024, published on 29 October 2024 following presidential assent and effective from 14 January 2025, marking a leap forward in its commitment to personal data privacy. This replaces the repealed Data Protection Act No.32 of 2018, reflecting the nation’s dedication to strengthening the regulatory framework for data protection and positioning itself as a leader in safeguarding individual privacy rights in Africa. This updated legislation introduces enhanced safeguards for personal data, covering its collection, processing, storage, and use, while setting legal standards to ensure accountability.

Key provisions of the new Act include its broad scope of application, which now extends to all government entities and organizations within Botswana that process personal data. The Act also applies to international entities outside Botswana that process personal data of individuals in Botswana — whether by transacting with them, offering goods or services to them, or monitoring their behaviour within the country. Such international entities are further mandated to appoint a Data Protection Representative resident or established in Botswana. The Act encompasses automated and non-automated processing of personal data intended to form part of a filing system and also excludes processing for personal or household data processing and data processing related to national security, defense, or public safety, provided adequate safeguards exist in specific legislation. Individuals are empowered with rights to access, correct, delete, and restrict processing of their data and can also request data portability and object to automated decision-making .

Cross-border data transfers are regulated, with Section 74 prohibiting the transfer of personal data outside Botswana unless specific conditions are met, such as ensuring that the destination country has adequate data protection measures in place and that such transfer is necessary for contractual, legal, or public interest reasons. Data controllers must notify the Information and Data Protection Commission within 72 hours of discovering a data breach and also, organizations conducting large-scale monitoring or processing sensitive data must appoint a Data Protection Officer (DPO) to oversee compliance and register their contact details with the Commission. Penalties for non-compliance may result in fines up to BWP 50 million or 4% of global turnover, and imprisonment for breaches of confidentiality or unauthorized data use.

Across Africa, other nations are also advancing their data protection regimes, often drawing inspiration from international standards like the GDPR. For example, South Africa’s Protection of Personal Information Act (POPIA) and Kenya’s Data Protection Act represent significant steps toward harmonizing data privacy standards across the continent. However, enforcement capabilities, awareness levels, and practical implementation remain uneven, creating a complex landscape for businesses operating in multiple African countries. Effectively navigating these diverse and evolving regulations requires a nuanced approach that balances legal compliance with local market realities.

Failure to comply with data protection regulations can lead to significant repercussions. Businesses risk substantial fines, legal disputes, and reputational damage that erode customer trust. Moreover, non-compliance can disrupt operations, limit market access, and deter investment in innovation. The risks associated with data breaches, unauthorized data sharing, and misuse of personal information are substantial, underscoring the need for robust data governance and proactive compliance measures.

Minchin & Kelly combines deep local expertise with regional insights to provide comprehensive data protection solutions. Our team assists clients in understanding and complying with Botswana’s Data Protection Act and related laws, developing data governance frameworks, conducting data protection impact assessments, and responding to data breaches. We also advise on cross-border data transfer mechanisms, privacy policies, and data security best practices. By partnering with us, businesses gain a trusted advisor capable of navigating the complexities of data protection law and minimizing compliance risks.

Botswana and Africa’s commitment to data protection is transforming the digital landscape, creating both challenges and opportunities for businesses. Minchin & Kelly is your strategic partner in navigating these complexities, ensuring compliance, and fostering a culture of data privacy that enhances trust and drives sustainable growth. Contact us today to learn how we can help you navigate the shifting sands of data protection regulations and unlock the full potential of your data-driven business.