Rebaone Ditlale
Lead Skills Consultant
Organisations collect and process large amounts of personal data, including workers’ records, customer details, identification documents, financial information and contact details daily. The introduction of Botswana’s Data Protection Act No.18 of 2025 (DPA) has increased the responsibility placed on organisations that process personal data. While businesses may have data protection policies and security measures in place, these measures won’t work unless workers are aware of their duties. Workers who handle personal data every day must understand their responsibilities under the law. Data protection training is therefore an important part of an organisation’s compliance programme.
Data protection in practice
Workers interact with personal data in almost every department; from human resources who handle employee records, to finance who processes banking information, to marketing who manages customer information, and IT who manages systems containing personal data. Training helps staff understand important data protection principles such as lawfulness, fairness, transparency, purpose limitation, data minimisation, storage limitation, integrity, confidentiality, and accountability. Workers need to be trained to understand that personal data should be processed for legitimate purposes only and handled responsibly.
Train to reduce data breaches
Workers can unintentionally cause data protection risks, and ignorance of the law is not an excuse. Sending an email containing personal information to the wrong recipient, leaving confidential documents unattended on a desk, or using weak passwords can expose an organisation to a data breach. Training provides workers with practical knowledge on how to protect personal data on a daily basis as they perform their tasks. Staff should know how to securely handle sensitive data, verify recipients before sharing information, identify phishing attempts and report suspected data breaches promptly.
Creating a culture of compliance
Data protection training should not be mistakenly treated as a once-off activity. Organisations should provide induction training for new hires and refresher training for existing staff. Refresher training is important as the law keeps changing so that organisations stay informed and compliant. Training should be designed in a way that they are tailored to the type of personal data handled by different workers regularly. Additionally, staff training and awareness have been identified as an important aspect in implementing the Data Protection Act in any organisation.
Our services
The Data Protection Act (DPA) mandates every organization to put strict safeguards regarding personal data and in that regard, we can assist with crafting Data Protection Policies in line with the said Act. Some organizations such as schools, hospitals, regulatory bodies, etc, are required to have full-time Data Protection Officers (DPO). If you cannot afford a full-time DPO, we can act as your organization’s DPO on a contract basis. If you need training for your staff on the provisions of the Data Protection Act and other business courses such as Leadership & Supervisory Skills, Customer Care, Team Building, as well as secondments of Tax, HR and DPOs, contact us at: +267 76 213 233 or +267 393 9435 or skills@aupracontax.co.bw. This article is general, and written advice or training is recommended if decisions are to be made. If you would like to join our free WhatsApp groups or to know more about our services, please send us a text/WhatsApp on the numbers above.
