What Is Data Protection Act, 2024 (Act No. 18 of 2024)?
The current statute is the Data Protection Act, 2024 (Act No. 18 of 2024), which commenced on 14 January 2025 by S.I. No. 4 of 2025. It repeals the former Data Protection Act, Cap. 43:14 while preserving compatible subsidiary legislation, pending proceedings, investigations, decisions, and administrative structures. The official 2024 legislation index identifies Act No. 18, not Act No. 4, as the Data Protection Act. The Act provides a broad rights framework covering transparency, indirect-source disclosure, access, rectification, erasure, restriction, recipient notification, portability, objection, direct-marketing opt-out, safeguards against solely automated decisions, consent withdrawal, complaints to the Commission, and compensation for material or non-material damage. Legal commencement should be distinguished from institutional rollout. Official reporting in July 2025 described the IDPC’s public website and contact channels as still being established, while February 2026 reporting confirms that the Commission was receiving and investigating complaints. No official primary-source provision-by-provision partial-commencement instrument for the 2024 Act was located.
At a glance
- Full name
- Data Protection Act, 2024 (Act No. 18 of 2024)
- Short code
- Data Protection Act 2024
- Jurisdiction
- Botswana
- Enacted
- 2024
- Last major update
- Data Protection Act, 2024 commenced on 14 January 2025 by S.I. No. 4 of 2025 and repealed the former Data Protection Act, Cap. 43:14
- Regulator
- Information and Data Protection Commission (IDPC)
- Private right of action
- Yes
- Statutory citation
- Data Protection Act, 2024 (Act No. 18 of 2024)
Scope, who Data Protection Act 2024 covers
Protected data
Data subject rights
Right to clear, transparent, intelligible, plain-language information about processing
Right to source disclosure where data was obtained indirectly, including whether it came from a publicly accessible source
Right of access to confirmation, personal data, processing details, recipients, retention criteria, source, transfer safeguards, and meaningful information about automated decision-making
Right to rectification and completion of inaccurate or incomplete data
Right to erasure where data is no longer necessary, consent is withdrawn without another legal basis, processing is unlawful, an objection succeeds, or erasure is legally required
Right to restriction of processing
Right to portability for qualifying automated consent- or contract-based processing
Unconditional right to object to direct marketing, including related profiling
Safeguards against solely automated decisions producing legal or similarly significant effects
Right to complain to the Information and Data Protection Commission
Right to compensation for material or non-material damage
Notable features
Botswana’s current Act replaced the former statute and commenced on a stated date of 14 January 2025. It combines GDPR-style rights with a Botswana-specific cross-border rule requiring a copy of transferred personal data to remain in Botswana for the period of processing.
Enforcement & penalties
Regulator: Information and Data Protection Commission (IDPC)
Penalties: Administrative fines include up to P10,000,000, or for an undertaking 2% of total worldwide annual turnover, whichever is higher, for the section 29 and section 52 obligations; and up to P50,000,000, or for an undertaking 4% of total worldwide annual turnover, whichever is higher, for core processing principles, data-subject rights, cross-border transfers, specified Part VII obligations, and non-compliance with Commission orders. Failure to implement Part XI security safeguards carries P500,000, imprisonment up to nine years, or both. Selling personal data carries P500,000, imprisonment up to nine years, or both. Obstructing an authorised Commission officer carries up to P500,000, imprisonment up to ten years, or both.
Private right of action: The Act provides compensation for material or non-material damage resulting from a contravention. Complaints to the Commission and appeals to the Appeals Tribunal are also identified, but no broader private procedural framework was located.
Relevance to data brokers
A data broker may be subject to the Act where it falls within the territorial scope for established controllers or processors, services offered to people in Botswana, or monitoring behaviour occurring in Botswana. No dedicated Botswana data-broker registry complaint, broker-specific deletion mechanism, or public-record removal route was located. This is not a claim that such a route is nonexistent.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Which Botswana data-protection law is currently in force?+
The Data Protection Act, 2024 (Act No. 18 of 2024) commenced on 14 January 2025 by S.I. No. 4 of 2025. The official 2024 legislation index identifies Act No. 18 as the Data Protection Act; Act No. 4 is the Bail Act.
What rights does Botswana’s Data Protection Act provide?+
The Act provides transparency, source disclosure, access, rectification, erasure, restriction, portability, objection, direct-marketing, automated-decision, consent-withdrawal, complaint, and compensation rights, subject to the Act’s identification rules and statutory exceptions.
Can I request deletion from a Botswana data broker?+
General erasure requests may be available where the Act’s conditions are met, followed by a complaint to the IDPC if appropriate. No dedicated Botswana data-broker registry complaint, broker-specific deletion mechanism, or public-record removal route was located.
Official sources & citations
Other international privacy regimes
Data Protection Act 2024 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: