The Information and Data Protection Commission (IDPC) has ordered the immediate suspension of the Directorate of Public Service Management’s (DPSM) ePayslip portal after finding multiple breaches of Botswana’s Data Protection Act.
In a public notice dated July 17, 2026, the Commission said it had issued both a Determination and an Enforcement Notice against DPSM for contraventions of the Data Protection Act No. 18 of 2024.
The action follows the launch of the ePayslip portal, which DPSM announced on June 10 through its official Facebook page. The portal was developed in collaboration with the Botswana Police Service, the Office of the Accountant General and the Department of Information Technology.
According to DPSM, the platform was intended to replace the manual and email-based distribution of public service payslips and ITW8 tax certificates.
After reviewing the portal and DPSM’s public communications, the Commission concluded that the directorate had failed to meet several legal obligations under the Act.
Among the findings, the Commission said DPSM “failed to identify and communicate an appropriate lawful basis for the processing of personal data through the ePayslip portal.”The regulator also found that DPSM had failed to comply with transparency requirements.
According to the notice, DPSM “failed to take appropriate measures to provide information relating to processing in a concise, transparent, intelligible and easily accessible form using clear and plain language.”
It also directed DPSM to immediately inform the public of the suspension, review and revise the portal’s privacy notice, conduct a DPIA in accordance with the law, and implement any mitigation measures arising from the assessment.The Commission further ordered DPSM to submit the completed DPIA, a revised privacy notice and documentary evidence demonstrating compliance with the enforcement orders within one month.
The Commission further determined that DPSM had not implemented adequate data protection safeguards before deploying the portal.
It stated that DPSM “failed to implement appropriate technical and organisational measures” required under Section 52 of the Act, which deals with data protection by design and by default.
The regulator also found that the directorate had not conducted a mandatory Data Protection Impact Assessment (DPIA) before developing and deploying the system.
According to the notice, DPSM “failed to carry out a DPIA prior to the development and deployment of the ePayslip portal to identify and mitigate any risks to the rights and freedoms of individuals.”
The Commission additionally raised concerns over provisions contained in the portal’s terms and conditions.
It said DPSM had included a disclaimer “purporting to exclude liability for personal data breaches or unauthorised access contrary to the accountability principle.”
As part of its enforcement action, the Commission ordered the immediate suspension of the ePayslip portal until all identified deficiencies are addressed.
It also directed DPSM to immediately inform the public of the suspension, review and revise the portal’s privacy notice, conduct a DPIA in accordance with the law, and implement any mitigation measures arising from the assessment.The Commission further ordered DPSM to submit the completed DPIA, a revised privacy notice and documentary evidence demonstrating compliance with the enforcement orders within one month.
“The Enforcement Notice directs DPSM to take the following actions within specified timelines,” the Commission stated in the notice.
The regulator warned that failure to comply could result in additional enforcement measures.”
The Commission cautioned DPSM that failure to comply may result in further enforcement and regulatory actions, including the imposition of an administrative fine,” the notice said.
