DATA PROTECTION ACT, 2018

# DATA PROTECTION ACT, 2018

No. 32


of 2018

# ARRANGEMENT OF SECTIONS

# SECTION

# PART I — Preliminary

1. Short title and commencement
2. Interpretation
3. Application

PART II — Information and Data Protection Commission

1. Establishment of Information and Data Protection Commission
2. Functions and powers of Commission
3. Staff of Commission
4. Powers of Commissioner
5. Oath of secrecy
6. Direction by Minister

PART III — Information and Data Protection Commission’s Specific

Powers in Relation to Processing of Personal Data

1. Right of access to information by Commissioner
2. Commission to seek rectification

12.Order to delete personal data 13. Collaboration with other bodies

PART IV Requirements and Criteria for Processing Data

1. Requirements for processing
2. Limitation to processing
3. Criteria for processing
4. Processing for other purposes

18.Processing for direct marketing 19. Revocation of consent

PART V — Processing of Sensitive Personal Data

Prohibition or processing sensitive personaldaa Safeguards for processing sensitive personaldata 22. Processing by bodies or entities 23.Processing for health or medical purposes

Processing for research, scientific and statistics purposes 25. Processing of genetic and biometric data Processing for legal purposes or by Government 27.Processing of identity card

# PART VI Data Collection, Right to Access and Duties of Data Controller

1. Information for data subject
2. Data collected from other sources
3. Rights of data subject
4. Authorisation to process

Safeguards for processing of personal data 33. Notification of breach to safeguards 34. Obligation to notify Commissioner 35. Exemption from notification 36.Data protection representative 37. Register maintained by data protection representative 38. Mandatory notification 39. Register maintained by Commissioner 40. Information provided by data controller or data protection representative

# PART VII Investigations and Enforcement

1. Investigation by Commissioner
2. Complaints
3. Enforcement notice

44.Variation or revocation of enforcement notice 45. Appeals Tribunal 46. Appeals 47. Proceedings of Tribunal

# PART VIII — Miscellaneous Provisions

1. Transborder flow of personal data

4Transfer of personal data to third country Protection from personal liability 51. Offences and penalties 52. Compensation for damages 53. Regulations 54. Transitional provisions

An Act to regulate the protection of personal data and to ensure that the privacy of individuals in relation to their personal data is maintained; to establish the Information and Data Protection Commission; and to provide for all matters incidental thereto.

Date of Assent: 03.08.2018

Date of Commencement: ON NOTICE

ENACTED by the Parliament of Botswana.

# PART I — Preliminary

1. This Act may be cited as the Data Protection Act, 2018 and shall come into operation on such a date as the Minister may, by Order published in the Gazette, appoint.
2. In this Act, unless the context otherwise requires —

"biometric data" means any information stemming from the statistical analysis of biological data;

"block” in relation to personal data, means the operation to suspend modification of data or suspend or restrict the provision of information to a third party when such provision is suspended or restricted in accordance with this Act;