Data Protection Officer – Letshego Botswana

Job Description

Job Summary

The DPO serves as: The primary liaison with the Data Protection Authority (DPA) The custodian of data protection governance The champion of privacy-by-design The coordinator of data breach response and data-subject rights management To drive Letshego Botswana’s full compliance with the Botswana Data Protection Act, 2024, related regulations, and global best practices in privacy and information governance. The role provides independent oversight, expert advisory, and monitoring of all data protection obligations, ensuring the ethical, lawful, secure, and transparent processing of personal data across the organisation.

Job Details

• Monitor and ensure compliance with applicable data protection laws, regulations, and guidelines, such as the Botswana Data Protection Act 2024 or any relevant legislation.
• Collaborate with key internal stakeholders in the review of projects and related data to ensure compliance with the DPA and where necessary, complete and advise on privacy impact assessments.
• Review and update privacy notices, consent forms, and other privacy-related documents to ensure they are accurate, transparent, and easily understandable.
• Maintain a comprehensive data inventory, documenting the types of data collected, processed, and stored, as well as the purposes and legal bases for processing.
• Serve as the primary point of contact for data protection queries in the business.
• Evaluate and monitor the data protection practices of third-party vendors and service providers with whom the organisation shares personal data.
• Maintain a data breach response plan, including incident identification, assessment, containment, notification, and mitigation.
• Conduct investigations into data breaches or security incidents, documenting findings and implementing corrective measures to prevent a recurrence.
• Handle and respond to data subject requests within the required timeframes, ensuring proper verification and authentication procedures are followed.
• Provide guidance and support to staff members who handle data subject requests or inquiries.
• Stay up to date with changes in data protection laws and guiding the organization on necessary adjustments to policies and procedures.
• Collaborate with relevant stakeholders to ensure that privacy considerations are embedded in the design and development of new products or services.
• Set standards and reviewing policies and procedures to the requirements under DPA.
• Design and deliver data protection training programs for employees and third parties to raise awareness of their responsibilities and obligations regarding data protection.
• Review and negotiate data protection clauses in contracts and agreements to ensure appropriate safeguards and compliance with data protection requirements.
• Coordinate and conduct data protection audits.
• Foster a culture of privacy and data protection throughout the organization by promoting best practices and continuous improvement.
• Promoting effective work practices, working as a team member and showing respect to co-workers.
• Role-models Letshego values and ethical leadership that is consistent with Group culture

Requirements

• Degree in Law, Computer Science, Information Systems, Risk Management, Cybersecurity, or related field.
• At least 3 years relevant experience in Data Protection, Information Governance, Risk, Compliance, Audit, Cybersecurity or related privacy fields.
• Experience in conducting data protection audits, risk assessments, and developing and implementing policies and procedures.
• Knowledge and hands-on application of Botswana Data Protection Act 2024, General Data Protection Regulation (GDPR), Data Lifecycle Management, Vendor Privacy Due Diligence.
• Professional data protection certification e.g.: CIPP/E, CIPM, Data Protection Practitioner Certification (recognised by DPA), ISO/IEC 27701 or 27001–related training.
• Strong knowledge of data protection laws and regulations, including the GDPR, Botswana Data Protection Act 2024 and other relevant privacy laws and regulations.
• Working knowledge of regulatory frameworks: NBFIRA, Bank of Botswana, AML/CTF, Data Protection.
• Sound knowledge of information governance, data lifecycle management and data security, including experience with data protection technologies and processes.
• Understanding of microfinance operations and risks posed by digital lending, mobile platforms, third-party integrations.
• Strong analytical and investigative capability. Ability to interpret law into operational controls. High attention to detail and accuracy.
• Excellent communication and training facilitation skills. Ability to challenge processes constructively and influence without authority.
• Strong organisational skills with ability to manage multiple concurrent requests.
• Ability to work independently with sound judgment and confidentiality.

Application Details

Closing date: 15 September 2026