Data Protection Act, 2024, compensation, administrative fines and offences

Data Protection Act, 2024 (Act No. 18 of 2024), Part XV (ss. 80-84)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 14 January 2025.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

Expect the Information and Data Protection Commission to investigate a data subject's complaint that your processing contravenes the Act, and to be able to impose an administrative fine for a contravention.
Compensate a data subject who suffers material or non-material damage from your contravention of the Act.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Section 84 creates criminal offences on top of the administrative-fine and compensation regime: a data controller who does not implement the security safeguards required under Part XI is liable to a fine of P500,000 or imprisonment for up to nine years, or both; a person who sells personal data commits the same offence at the same penalty; and a person who contravenes any other provision of the Act, where no other penalty is provided, is liable to a fine not exceeding P500,000 or imprisonment for a term not exceeding nine years, or both.

Penalty structure

Section 83(3) sets the higher administrative-fine tier: up to P50,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for a contravention of the core processing principles and consent conditions (Parts IV to VI), data-subject rights (Part VIII), cross-border transfer rules (Part XIV), obligations under a restricting law (Part VII), or an order of the Commission. Section 83(2) sets a narrower lower tier, up to P10,000,000 or 2 percent of worldwide annual turnover, whichever is higher, for a contravention of the children's-consent duty (section 29) or the data-protection-by-design and by-default duty (section 52) specifically. Separately, section 84's criminal offences (failing to implement required security safeguards, selling personal data, or any other contravention with no other penalty provided) carry a fine of up to P500,000 alongside imprisonment of up to nine years; neither criminal track exceeds the P50,000,000 fixed_cap recorded here.

Rule: Higher of
As of: 19 September 2026
Currency: BWP
Fixed cap: 50,000,000
Turnover percentage cap: 4

Who enforces it

Enforcement body

Information and Data Protection Commission

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A data subject may lodge a complaint with the Information and Data Protection Commission if they consider that processing of their personal data contravenes the Act, and the Commission must inform the complainant of the progress and outcome of the complaint. A person who suffers material or non-material damage from a contravention of the Act is entitled to compensation from the data controller or data processor.

The Commission may impose an administrative fine of up to P50,000,000, or four percent of an undertaking's total worldwide annual turnover of the preceding financial year, whichever is higher, for a contravention of the processing principles and consent conditions, data-subject rights, cross-border transfer rules, an obligation under a restricting law, or a Commission order, and a lower fine of up to P10,000,000, or two percent of worldwide annual turnover, whichever is higher, for a contravention of the children's-consent duty or the data-protection-by-design duty specifically.

A person who fails to implement required security safeguards, who sells personal data, or who otherwise contravenes the Act where no other penalty is specified, commits an offence carrying a fine of up to P500,000 or imprisonment of up to nine years, or both.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Data Protection Act
2024, Government Gazette Extraordinary Vol. LXII, No. 144 of 29 October 2024, reproduced by dpo-india.com, with the commencement day from the Botswana Laws bulletin entry for the Act

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app