Clause 15.5. of the Service and Application License terms and conditions provides that all accounts and records of Licensee shall be kept in secure locations and secure formats designed to ensure their preservation.
Performance related data shall be retained by the Licensee for a minimum of one year, and all financial records shall be retained by the Licensee for a minimum of five years.

Section 10 of the Data Protection Act gives the Commissioner the power to access any personal data that is processed without a requirement for court order to obtain the information. The Commissioner simply has to request for the information or document in writing. The Commissioner also has to stipulate the timeframes within which information should be provided. A person who does not comply with the Commissioner's request is liable to a sanction.

Botswana has a comprehensive data protection regime under the Data Protection Act, 2018. In addition, there are other laws in place: the Cybercrime and Computer Related Crimes Act, 2018, and Financial Intelligence Act, 2019.

Section 25 of the Electronic Payments Services Regulations mandates that information should be retained by a licensee (a company that is licensed to operate an electronic payment service) for a minimum of five years from the date the transaction was concluded and after termination of the business relationship.

Section 28 of the Financial Intelligence Act provides that information obtained from the customers through customer due diligence, account files and correspondence should be retained for twenty years from the date the transaction was concluded and after the termination of the business relationship.

Section 20 of the Data Protection Act (DPA) prohibits processing of sensitive personal data except under certain circumstances. These include:
- The processing is specifically provided for under the DPA;
- The data subject has given consent in writing;
- The data subject has made the data public;
- The processing is necessary for national security, for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment, or where the processing is authorized by any other written law for any reason of substantial interest to the public; or
- The processing is necessary to protect the vital interest of a data subject and another person in a case where consent cannot be given by or on behalf of the data subject, the data controller cannot be reasonably expected to obtain consent or the consent by or on behalf of the data subject has been unreasonably withheld.
It is not clear whether a data transfer is considered a form of processing.

Section 48 of the Data Protection Act (DPA) prohibits the transfer of personal data from Botswana to another country, unless the personal data that is undergoing processing or intended processing is transferred to a third country which ensures an adequate level of protection. Such level of protection will be assessed by the Commissioner in light of all the circumstances surrounding the data transfer operation in accordance with Sections 49 (1)-(4). Alternatively, the transfer is allowed if there is the consent of the data subject or where the transfer is:
- Necessary for the performance of a contract between the data subject and the data controller, or the implementation of pre contractual measures taken in response to the data subject’s request;
- Necessary for the performance or conclusion of a contract in the interests of the data subject between the data controller and a third party;
- Necessary for the public interest, or for the establishment, exercise or defence of a legal claim;
- Necessary to protect the vital interests of the data subject; or
- Made from a register that is intended to provide the public with information and is open to public inspection.

Botswana has not joined any free trade agreement committing to open transfers of cross-border data flows.

It is reported that the Botswana Communication Regulatory Authority (BOCRA), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

According to Sections 189 and 190 of the Companies Act, 2007, a company limited by shares must keep accounting records including invoices relating to the sale and supply of goods at its registered office or such other place in Botswana as the board of the company shall determine.

It is reported that Botswana does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation since 2012.

Botswana has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that there is an obligation for passive infrastructure sharing in Botswana to deliver telecom services to end users. It is practiced in the mobile sector and in the fixed sector based on commercial agreements.

The Botswana Telecommunications Corporation Limited (BTCL) is a telecommunications company which was formerly a government parastatal. Clause 6.2 of the Constitution of the BTCL states that no shares shall be issued to foreigners. This therefore foreigners cannot own shares in this telecommunications company, which is also the only listed telecommunications company in Botswana.

The incumbent Botswana Telecommunications Corporation Limited (BTCL) remains a state-owned enterprise. The Government of Botswana holds 51% shares in the company.