How to write a privacy notice for a Botswana business (Data Protection Act 2024)

The law: Data Protection Act, 2024 (Act No. 18 of 2024), sections 37 to 41 and 48. The body: Information and Data Protection Commission. In force: 14 January 2025. Last checked: 22 October 2026

This guide is for owners and managers who collect customer, staff or supplier details and have no notice yet. It moves from a list of what you collect to a finished notice, line by line against the Act, with a fill-in template at the end.

Privacy notice Botswana: start by listing what you collect, why, and who sees it

The Act ties every line of a notice to a fact about your processing, so write those facts down first. For each type of personal data, record what it is, why you collect it, where it comes from, who receives it, and how long you keep it. Our guide to data protection basics explains the wider principles, and why fast-growing teams need data protection standards covers the internal controls behind the notice.

A small business usually has four or five types: customer contacts, staff records, supplier contacts, website or app data and, in some cases, camera images. Give each its own row. The notice is built from this list.

That list is close to the record of processing activities in section 60, which a data controller keeps in writing: the purposes, the categories of data subjects and personal data, the recipients, any transfers abroad, and, where possible, the time limits for erasure and the security measures. An enterprise employing fewer than 250 persons is exempt from keeping that record unless its processing is likely to result in a risk to data subjects, is not occasional, or includes sensitive personal data (section 60(4)). In Brimco’s reading, a business that collects customer data every day is unlikely to count as occasional processing, so keep the record anyway.

A notice must carry five facts at the moment you collect the data

Section 39(1) requires you, when you obtain personal data from the data subject, to provide five items. The table gives each with the wording a small business could use.

Section	What the Act requires	Plain wording to use
39(1)(a)	Identity and contact details of the data controller, and its representative where applicable	“We are [company name], [address], [phone], [email].”
39(1)(b)	Contact details of the data protection officer	“Contact [name or role] at [email].”
39(1)(c)	The purpose of the processing and the legal basis	“We use your phone number to confirm deliveries, because we need it to carry out your order.”
39(1)(d)	The legitimate interests pursued, where the basis is legitimate interests	“We keep CCTV to protect our stock and staff.”
39(1)(e)	The recipients or categories of recipients	“We share your details with our delivery partner and our accountants.”
Section 39(2) adds two items where they apply. If you intend to transfer data to another country or an international organisation, say so, and say whether an adequacy decision exists under section 75. Section 39(3) asks for a reference to the safeguards for certain transfers.

Section 69(1) makes a data protection officer compulsory for public authorities and for core activities of large-scale monitoring or large-scale sensitive data. Other businesses may designate one under section 69(2).

If you have none, section 39(1)(b) still asks for contact details. Ask the Commission what to write in that line.

Seven more facts complete the privacy notice, and most small businesses use them all

The Botswana Data Protection Act also requires, in section 40(1), at the same time, “further information necessary to ensure fair and transparent processing”. These are the items.

Section	What the Act requires	Plain wording to use
40(1)(a)	The storage period, or the criteria used to decide it	“We keep invoices for as long as the law requires, then delete them.”
40(1)(b)	The rights to access, rectification, erasure and restriction	“You can ask to see, correct, delete or limit our use of your data.”
40(1)(c)	The rights to data portability and to object	“You can ask for a copy in a usable format and object to some uses.”
40(1)(d)	The right to withdraw consent, where consent is the basis	“Where you agreed, you can withdraw at any time.”
40(1)(e)	The right to complain to the Commission (section 80)	“You can complain to the Information and Data Protection Commission.”
40(1)(f)	Whether giving the data is a legal or contract requirement, and the consequence of refusing	“We cannot process your order without a delivery address.”
40(1)(g)	Any automated decision-making, including profiling	“We make no decisions by automated means.”
Section 40(3) says sections 39 and 40 do not apply where, and insofar as, the data subject already has the information. That helps with repeat forms, but a first-time customer has none of it.

Data you collect from someone else needs the source and categories, within one month

Where personal data does not come from the data subject, such as a referral or a purchased list, section 41(1) requires the sections 39 and 40 information plus two more items. They are the source of the data, including whether it came from a publicly accessible source, and the categories of data concerned.

Section 41(2) sets the timing. Give it within a reasonable period, not exceeding one month. If you will use the data to contact the data subject, give it at the first communication. If you will disclose it to another recipient, give it when you first do so. Section 41(4) lists exceptions, including where the data subject already has the information.

Plain language and a written form are the legal style requirements.

Section 37(1) requires information addressed to a person to be concise, transparent, intelligible and easily accessible, in clear and plain language. Section 37(2) requires it in writing, including by electronic means. Where the data subject asks, you may give it orally, provided their identity is proven (section 37(3)).

In practice that means short sentences, headings that say what each part covers, and no legal citations in the notice itself. Keep the section numbers in your internal file, not in front of customers.

Sensitive personal data, data processors and breaches: the definitions behind the notice

The Botswana Data Protection Act, 2024 defines sensitive personal data as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, biometric data used to uniquely identify a person, data concerning health, or data about a person’s sex life or sexual orientation. It also covers data about offences and related proceedings, and personal data of a minor (section 2). If your data list includes any of these, mark it in the notice, because processing sensitive personal data is governed by Part VI of the Act (sections 30 to 33).

A data processor is a person who processes personal data on behalf of the data controller under sections 55 and 56, such as an IT host, payroll bureau or delivery firm. Data processors handle data under a contract or law, so list them among the recipients in section 39(1)(e).

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (section 2). Your security measures and security safeguards are described in the notice; the breach duty itself is covered below.

Name the legal basis honestly, because the notice must state it

Section 26 allows processing only where at least one ground applies. The six are consent, a contract with the data subject, a legal obligation, protecting vital interests, a public interest duty or official authority, and legitimate interests. Legitimate interests do not apply where the data subject’s rights override them, especially a child’s.

Do not tick consent as a default. Where you rely on consent you must be able to demonstrate it (section 27(1)).

If a written declaration covers other matters, the request for consent must be clearly distinguishable and in plain language (section 27(2)). Consent tied to a service when the data is not needed for it is invalid (section 27(4)).

Section 28(3) requires you to tell the data subject, before you obtain consent, that they can withdraw it. Section 29 sets a parent-based consent rule for children using information society services, with a prescribed manner where the child is 16.

Direct marketing needs a separate, upfront statement of the right to object

Section 48(3) gives a person the right to object at any time to processing for direct marketing, including profiling related to it. Once they object, the data may not be processed for that purpose (section 48(4)).

Section 48(5) adds a presentation rule. At the time of the first communication, the rights in section 48(1) and (2) must be brought explicitly to the data subject’s attention, clearly and separately from other information. A line buried in a long notice does not meet that test on its face.

Put the notice where the data is collected, and keep each version

The Act requires the information “at the time when personal data is obtained” (section 39(1)). So the notice belongs on the form, the till point, the sign-up screen and the web page where you collect. A short layer at the point of collection, linking to the full text, is a sensible way to do this.

Section 25 makes the data controller responsible for, and able to demonstrate, compliance with the principles, including transparency under section 19. Brimco suggests keeping a dated copy of each version of the notice and noting the dates it was live. That is Brimco’s suggestion, not a duty in the Act.

Section 40(2) requires you to inform people before you use their data for a new purpose. That is the trigger to update the notice. Requests under sections 42 to 49 must be answered within one month, with no charge except for manifestly unfounded or excessive requests (section 38(3) and (8)). Say how people can make them.

A privacy notice template for a Botswana business that follows sections 39 and 40

Worked example. Privacy notice for [business name]

Who we are. [Business name], [registered address]. You can reach us at [email] or [phone]. Our data protection contact is [name or role], [email].

What we collect and why. We collect information you give us, such as your name, contact address, physical address and other personal details, and the contact details provided on our forms. We collect [list of data] to [purpose]. We do this because [consent / we need it for your contract / the law requires it / our legitimate interest in …].

Who we share it with. [Recipients or categories, for example delivery partners, accountants, IT providers]. [We send some data outside Botswana to [country] and rely on [safeguard]. / We do not send your data outside Botswana.]

Website and app data. When you visit our website we collect usage information, such as your device, operating system and pages visited, through cookies. You can disable cookies in your browser settings.

Payments. We use a payment provider to process payments. We do not store full card details.

Service providers. We use third party service providers, such as cloud services, IT support and insurance providers, who process personal data on our behalf under contractual agreements and appropriate confidentiality terms.

Legal disclosures. We may share personal data with law enforcement agencies, fraud prevention agencies or regulators where applicable laws require it.

Marketing. We send marketing communications only where you have agreed or where the law allows. You can object to the use of your personal data for direct marketing purposes at any time.

Security. We use security measures and appropriate safeguards to protect personal data held by us against unauthorised access, loss or misuse.

How long we keep it (data retention). [Period, or the rule used to decide it]. We take reasonable steps to keep personal data accurate and to correct or erase inaccurate data without delay.

Research. [Only if you do this: We use personal data collected from customers to conduct market research and statistical analysis, and we use summary figures where we can.]

Your data protection rights. You can ask to access personal data we hold about you, correct it, delete it, limit our use of it, receive a copy in a usable format, or object to our use of it, including for marketing. Where we rely on your consent, you can withdraw it at any time. We reply within one month. You can also complain to the Information and Data Protection Commission.

Do you have to give us this data? [Yes, because … / No. If you do not, we cannot …].

Automated decisions. [We make no decisions about you by automated means. / We use automated decisions for …, and this is how they work and what they mean for you.]

This is general information, and the Commission confirms what it expects.

This article is general information about the Data Protection Act, 2024. It is not legal advice. Brimco read the Act as printed in the Government Gazette Extraordinary of 29 October 2024 through a third-party copy, and did not find a Commission template or guidance. Confirm your final wording with a lawyer or the Commission.

Good data privacy and regulatory compliance start with a sound company structure. Brimco’s corporate governance services can help, and our company registration service sets up new businesses correctly. If a data breach happens, the data controller must notify the Commission without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put data subjects at risk (section 63). Read what you should know about protecting digital information for practical cybersecurity steps.

Questions

What is a data privacy notice?

A privacy notice explains to people how a data controller collects, uses, shares and stores their personal data, and what rights they have. Under the Data Protection Act, 2024 it must carry the facts in sections 39 and 40.

Is a privacy notice mandatory in Botswana?

Yes, in substance. The Act does not use the words “privacy notice”, but section 39 requires every data controller to give the listed information when personal data is collected, and section 37 requires it in writing in plain language.

Who must provide a privacy notice, and who is entitled to receive one?

Every data controller whose data processing is covered by the Act must provide the information, and every data subject whose personal data is collected is entitled to receive it. Where data comes from someone else, section 41 still requires it within one month.

Is a privacy policy the same as a privacy notice?

Usually no. A privacy policy is an internal document setting out how staff handle personal data. A privacy notice is the external statement given to data subjects. Many businesses publish the notice on their website under the name “privacy policy”.

Can you write your own privacy notice?

Yes. The Act sets the content, not the author. Use the template above, check each line against your data list, and take advice if you process sensitive personal data or transfer data abroad.

What is the latest data protection act in Botswana?

The Data Protection Act, 2024 (Act No. 18 of 2024), in force since 14 January 2025. It repealed the earlier Data Protection Act (Cap. 43:14) and is enforced by the Information and Data Protection Commission.

Do I need a privacy notice if I only collect names and phone numbers?

Yes. Section 39 applies whenever you collect personal data from the data subject. A name and a phone number are personal data. Section 40(3) removes the duty only where the data subject already has the information.

Does a privacy notice replace consent?

No. The notice tells people what you do. Consent is one legal ground in section 26(a), and it has its own conditions in sections 27 and 28. If you rely on another ground, the notice must say which one (section 39(1)(c)).

Do I need a data protection officer’s details in the notice?

Section 39(1)(b) asks for them. Section 69(1) makes a designation compulsory for public authorities and for large-scale monitoring or sensitive data as a core activity. Others may designate one under section 69(2). Ask the Commission what to say if you have none.

How long must I say I keep the data?

Section 40(1)(a) requires the storage period or, if that is not possible, the criteria used to decide it. Section 23 also says data may be kept in identifiable form for no longer than necessary for the purpose.

Can I give the notice verbally?

On request, yes, if the data subject’s identity is proven (section 37(3)). The default is writing, including electronic means (section 37(2)). A sign or screen at the point of collection, linked to the full text, is the common written route.