Data Protection Act, 2018 (No. 32 of 2018)

A.535

# DATA PROTECTION ACT, 2018

No. 32

!img-0.jpeg

of 2018

# ARRANGEMENT OF SECTIONS

SECTION

PART I — Preliminary

1. Short title and commencement
2. Interpretation
3. Application

PART II — Information and Data Protection Commission

1. Establishment of Information and Data Protection Commission
2. Functions and powers of Commission
3. Staff of Commission
4. Powers of Commissioner
5. Oath of secrecy
6. Direction by Minister

PART III — Information and Data Protection Commission's Specific Powers in Relation to Processing of Personal Data

1. Right of access to information by Commissioner
2. Commission to seek rectification
3. Order to delete personal data
4. Collaboration with other bodies

PART IV — Requirements and Criteria for Processing Data

1. Requirements for processing
2. Limitation to processing
3. Criteria for processing
4. Processing for other purposes
5. Processing for direct marketing
6. Revocation of consent

PART V — Processing of Sensitive Personal Data

1. Prohibition for processing of sensitive personal data
2. Safeguards for processing sensitive personal data
3. Processing by bodies or entities
4. Processing for health or medical purposes

A.536

1. Processing for research, scientific and statistics purposes
2. Processing of genetic and biometric data
3. Processing for legal purposes or by Government
4. Processing of identity card

PART VI — Data Collection, Right to Access and Duties of Data Controller

1. Information for data subject
2. Data collected from other sources
3. Rights of data subject
4. Authorisation to process
5. Safeguards for processing of personal data
6. Notification of breach to safeguards
7. Obligation to notify Commissioner
8. Exemption from notification
9. Data protection representative
10. Register maintained by data protection representative
11. Mandatory notification
12. Register maintained by Commissioner
13. Information provided by data controller or data protection representative

PART VII — Investigations and Enforcement

1. Investigation by Commissioner
2. Complaints
3. Enforcement notice
4. Variation or revocation of enforcement notice
5. Appeals Tribunal
6. Appeals
7. Proceedings of Tribunal

PART VIII — Miscellaneous Provisions

1. Transborder flow of personal data
2. Transfer of personal data to third country
3. Protection from personal liability
4. Offences and penalties
5. Compensation for damages
6. Regulations
7. Transitional provisions

A.537

An Act to regulate the protection of personal data and to ensure that the privacy of individuals in relation to their personal data is maintained; to establish the Information and Data Protection Commission; and to provide for all matters incidental thereto.

Date of Assent: 03.08.2018

Date of Commencement: ON NOTICE

ENACTED by the Parliament of Botswana.

PART I — Preliminary

1. This Act may be cited as the Data Protection Act, 2018 and shall come into operation on such a date as the Minister may, by Order published in the Gazette, appoint.

1. In this Act, unless the context otherwise requires —

“biometric data” means any information stemming from the statistical analysis of biological data;