Botswana

Botswana's comprehensive personal-data statute is the Data Protection Act, 2024 (Act No. 18 of 2024), passed by the National Assembly on 19 August 2024, assented to on 24 October 2024, published in Government Gazette Extraordinary Vol. LXII, No. 144 of 29 October 2024, and brought into force on 14 January 2025 by Statutory Instrument 4 of 2025, repealing the earlier Data Protection Act, 2018 (Cap. 43:14).

It applies to automated and non-automated processing of personal data by a controller or processor established in Botswana, and reaches a foreign controller or processor that offers goods or services to people in Botswana or monitors their behaviour there; it binds the State and excludes only purely personal or household processing and specified state functions such as national security, defence, and law enforcement, to the extent adequate safeguards exist elsewhere.

It prohibits processing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health data, and sex-life or sexual-orientation data, subject to listed exceptions including the data subject's explicit consent and data the data subject has manifestly made public.

A controller must notify the Information and Data Protection Commission within 72 hours of becoming aware of a personal-data breach, where feasible, unless the breach is unlikely to risk a person's rights and freedoms, and must communicate the breach to the affected person without undue delay where the risk is high. Processing a child's personal data for an information-society service offered directly to them needs parental or guardian consent unless the child is at least sixteen.

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to narrow exceptions and safeguards including human intervention and a right to contest the decision.

A transfer of personal data to a third country or an international organisation needs an adequacy finding by the Commission, appropriate safeguards such as standard contractual clauses, approved binding corporate rules, or a listed derogation, and the Act additionally requires that a copy of any transferred personal data remain in Botswana for the period of processing.

Enforcement combines administrative fines the Commission can impose directly, a private right to compensation for a data subject who suffers material or non-material damage from a contravention, and criminal offences for failing to implement required security safeguards, selling personal data, or otherwise contravening the Act where no other penalty is specified.

Open-web crawling of public pages carries no dedicated Botswana statute.

The applicable authority for unauthorized-access questions is the Cybercrime and Computer Related Crimes Act, 2018 (Act No. 18 of 2018), which criminalizes intentionally accessing or attempting to access all or part of a computer or computer system knowing the access is unauthorised, or causing a computer system to perform a function as a result of such unauthorised access (section 4), and separately criminalizes securing unauthorised access to a computer service or intercepting data (section 5); no Botswana court decision construes how authorisation is read for a public, unauthenticated page, and the Act's own definition of "unauthorised access" turns on entitlement or consent rather than on any technical measure, so it does not by its terms exempt a public page.

The Act was assented to on 29 June 2018 and came into force on 4 July 2018 by Statutory Instrument 83 of 2018; the current consolidated Laws of Botswana list its provisions under Chapter 08:06, which the Act itself confirms it repeals and re-enacts.

The Act carries no exemption for a search engine, indexer, or host from liability for unauthorised access or interference; its only host-facing duty is a bar on a service provider disclosing that a preservation, production, or surveillance order has been made against it (section 23).

No statute or case law addressing terms-of-service enforceability (browsewrap versus clickwrap), or whether login or acceptance of terms changes the legal picture, exists; ordinary contract-formation principles under Botswana's general law of contract would be the applicable general law for a contract-formation question, but this is unsettled rather than a specific regime.

Copyright protects a database only as a compilation, never through a separate sui generis right: the Copyright and Neighbouring Rights Act, 2000 (Cap. 68:02, as amended by Act 6 of 2006) defines "literary work" to include "a table of compilation", and separately withholds the Act's private-reproduction exception from "the whole or a substantial part of a data base", so a database that is an intellectual creation through the selection or arrangement of its contents is protected as a literary work, while the underlying facts and data are not protected as such.

Personal-data reach over scraped public personal data is governed by the Data Protection Act, 2024, researched in full under the privacy topic; its scope provisions carry no publicly-available-data exemption, so ordinary personal data scraped from a public source remains within the regime's reach, and processing that reveals a sensitive category, including a biometric identifier used to uniquely identify a person, is prohibited unless a listed exception applies, one of which is data the data subject has manifestly made public.

No specific unfair-competition or misappropriation doctrine addressed to scraping, and no case law or regulatory statement giving robots.txt legal weight or addressing AI-training-specific access rules, exists.

Botswana has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.

The relevant instrument is the Copyright and Neighbouring Rights Act, 2000 (Cap. 68:02, as amended by Act 6 of 2006), whose neighbouring-rights Part protects only performers, producers of sound recordings, and broadcasting organisations, not print or online news publishers, so there is no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates.

The Act lets a newspaper or periodical, broadcaster, or other communicator to the public reproduce, without the author's authorisation but subject to naming the author and source, an article on current economic, political, or religious topics published in a newspaper or periodical, or a broadcast work of the same character, provided the right to authorise such reproduction has not been expressly reserved by the author or owner of copyright (section 18(a)); this express-reservation proviso functions as an author-side opt-out mechanism for that specific exception, the closest Botswana law comes to a machine-readable reservation, though it long predates the concept of one and is not framed as machine-readable.

The Act separately permits reproducing, broadcasting, or otherwise communicating short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by the purpose (section 18(b)), and permits quotation of a short part of a published work compatible with fair practice and not exceeding the extent justified by the purpose, provided the source and author are named (section 14).

Neither exception is capped at a headline-length or short-extract threshold in the way some jurisdictions' quotation rights are, the section 18(a) exception is not confined to the press industry, and no reported Botswana decision applies either provision to a systematic news aggregator as opposed to a traditional newspaper or broadcaster.

The Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists, and no statute or case law addressing whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, exists.