DATA PROTECTION ACT, 2018

No. 32

of 2018

ARRANGEMENT OF SECTIONS

SECTION

PART I — Preliminary

1. Short title and commencement
2. Interpretation
3. Application

PART II — Information and Data Protection Commission

1. Establishment of Information and Data Protection Commission
2. Functions and powers of Commission
3. Staff of Commission
4. Powers of Commissioner
5. Oath of secrecy
6. Direction by Minister

PART III — Information and Data Protection Commission’s Specific Powers in Relation to Processing of Personal Data

1. Right of access to information by Commissioner
2. Commission to seek rectification
3. Order to delete personal data
4. Collaboration with other bodies

PART IV — Requirements and Criteria for Processing Data

1. Requirements for processing
2. Limitation to processing
3. Criteria for processing
4. Processing for other purposes
5. Processing for direct marketing
6. Revocation of consent

PART V — Processing of Sensitive Personal Data

1. Prohibition of processing sensitive personal data
2. Safeguards for processing sensitive personal data
3. Processing by bodies or entities
4. Processing for health or medical purposes
5. Processing for research, scientific and statistics purposes
6. Processing of genetic and biometric data
7. Processing for legal purposes or by Government
8. Processing of identity card

PART VI Data Collection, Right to Access and Duties of Data Controller

1. Information for data subject
2. Data collected from other sources
3. Rights of data subject
4. Authorisation to process

Safeguards for processing of personal data 33. Notification of breach to safeguards 34. Obligation to notify Commissioner 35. Exemption from notification 36. Data protection representative 37. Register maintained by data protection representative 38. Mandatory notification 39. Register maintained by Commissioner 40. Information provided by data controller or data protection representative

PART VII Investigations and Enforcement

41. Investigation by Commissioner

42. Complaints

43. Enforcement notice

44. Variation or revocation of enforcement notice

45. Appeals Tribunal

46. Appeals

47. Proceedings of Tribunal

PART VIII — Miscellaneous Provisions

1. Transborder flow of personal data

4Transfer of personal data to third country Protection from personal liability 51. Offences and penalties 52. Compensation for damages 53. Regulations 54. Transitional provisions

An Act to regulate the protection of personal data and to ensure that the privacy of individuals in relation to their personal data is maintained; to establish the Information and Data Protection Commission; and to provide for all matters incidental thereto.

Date of Assent: 03.08.2018

Date of Commencement: ON NOTICE

ENACTED by the Parliament of Botswana.

PART I — Preliminary

Short title and commencement

1. This Act may be cited as the Data Protection Act, 2018 and shall come into operation on such a date as the Minister may, by Order published in the Gazette, appoint.

Interpretation

1. In this Act, unless the context otherwise requires —

"biometric data" means any information stemming from the statistical analysis of biological data;