If your organisation decides how and why personal data is processed, Botswana’s Data Protection Act, 2018 requires you to register as a data controller with the Information and Data Protection Commission. We deliver a GDPR-grade privacy programme that satisfies both the Commission and your international business partners.

What’s included

• Data mapping and Article-30-style processing register
• Lawful-basis and legitimate-interests assessment (LIA)
• Data-Protection Impact Assessment (DPIA) template and one worked example
• Privacy-notice suite (customer, employee, website)
• Retention schedule and minimisation controls
• Data-processor contract templates and vendor register
• International-transfer safeguards (SCC-equivalent clauses)
• Breach-response playbook and 72-hour notification template

Who it’s for

• Fintechs, insurtechs and healthtechs processing sensitive data
• E-commerce and marketplace businesses with customer databases
• HR-heavy employers with cross-border data flows
• Multinationals aligning Botswana ops with group GDPR posture

Why The Secretary

• Team includes GDPR-certified (CIPP/E, CIPM) privacy specialists
• Frameworks built to interlock with EU GDPR, UK DPA 2018, ISO/IEC 27701 and NIST Privacy Framework v1.0
• Templates ready for direct use — no boilerplate filler
• Optional outsourced DPO retainer for ongoing representation

How we work

1. Scoping and data-flow interviews (week 1)
2. Register, policy and notice drafting (weeks 2–3)
3. Client review and staff briefing
4. Commission registration and receipt
5. Optional follow-on: DPIA, ISO 27701 readiness, DPO retainer

Related services

High-relevance pairings include BOCRA ISP Licence (data-heavy operators), NBFIRA Investment Advisory Licence (financial PII) and Pty Ltd incorporation.

Scope

From price covers: registration with the Commission, Article-30-equivalent processing register, one privacy notice, one DPIA walk-through. Quoted separately: ISO/IEC 27701 certification readiness, full privacy-programme implementation across multiple entities, outsourced DPO retainer, incident-response engagements.