Data protection in Namibia: what the draft Bill says, and what to do before it passes

Where the Bill stands

A Data Protection Bill was published as a draft in March 2022. In January 2026 the ministry was reported to say consultations were complete and the draft was ready for resubmission to the Cabinet Committee on Legislation, a procedural step required before introduction in Parliament. The Southern African Times carried the same account. No enactment or commencement had been reported as at 7 October 2026. Existing protection comes from sector-specific rules, including banking secrecy duties, and from the constitutional right to privacy.

The text on file is an undated draft with tracked-change residue and reviewer comments. Its contents list shows sections 40 to 44 for penalties, commencement and repeal which the text does not contain. Its section on exceptions cites the wrong section for breach notification. Section numbers belong to this draft and will move if a different version is tabled.

The shape of the draft

The draft follows the GDPR and POPIA family. Controllers and processors are defined, and processors act on written instructions under a contract with five stated terms (section 18(4)). Principles include purpose limitation, minimisation, accuracy and storage limitation (section 3). Lawful bases include consent, contract, legal obligation, vital interests, legitimate interests and public interest (section 4). Consent must be demonstrable, specific, and as easy to withdraw as to give (section 5). Children means anyone under 18 (section 6). Special categories include biometric data, health data, religious belief and criminal records, and are prohibited unless safeguards apply (section 7).

Rights follow: access, with the reasoning behind processing (section 8), rectification, erasure and restriction (section 9), objection and a ban on electronic direct marketing without prior consent (section 10), no significant decision based solely on automated processing without human intervention (section 11), and compensation (section 14). Duties include transparency (section 16), privacy by design and default (section 17), security measures including encryption, resilience and timely restore (section 18), records of processing (section 20) and impact assessments for profiling, large-scale special category processing and large-scale monitoring of public areas (section 21).

Two clocks stand out. A controller must notify the authority of a breach without undue delay and within 72 hours, unless a high risk is unlikely, and must give reasons for any delay. A processor must tell the controller without undue delay (section 22). Where the risk is high, people are told in plain language, unless the data was unintelligible through encryption, the risk is no longer likely, or the effort would be disproportionate (section 23). Transfers abroad need an appropriate level of protection through the receiving country’s law or binding safeguards, with a documented assessment (section 24).

Where the draft is silent

Section 35 lists warnings, formal notices, limits on processing and bans, and says a financial penalty is to be calculated, with no formula. The draft states no right to receive one’s data in portable form, which GDPR gives in Article 20. It names a data protection officer only as a contact in the processing record. It sets no fixed retention periods and leaves registration to a fee based on turnover and staff numbers (section 37), without a procedure.

For comparison, POPIA requires notification of a compromise as soon as reasonably possible, with no hour count. GDPR gives one month to answer requests with a possible two-month extension. The Namibian draft sits in between, with one month and one extension. Where laws differ, an organisation serving customers in several countries should apply the stricter rule.

Why build to the draft now

Three reasons make waiting poor strategy. The draft follows well-known models, so its final form is unlikely to differ in principle. Banking confidentiality expectations already apply to payment data whatever the statute says. And retrofitting minimisation is expensive. Deciding not to collect a field costs nothing, while deleting it from years of backups, logs and derived tables costs a great deal.

Rights and clocks side by side

A table in prose helps a reader plan. Access: one month, extendable by one more with reasons, free of charge except where a request is excessive or manifestly unfounded (section 8). Rectification, erasure and restriction: without excessive delay and free of charge, with recipients told unless impossible or disproportionate (section 9). Objection: at any time and free of charge, with an objection to marketing ending the use of the data for marketing (section 10). Automated decisions: a right to human intervention, to give a view and to challenge (section 11). Breach: 72 hours to the authority, then plain-language notice to people where risk is high (sections 22 and 23).

The authority’s own powers matter for planning. It receives complaints and must tell the complainant how to proceed if it fails to act within three months (section 33(1)(k)). It maintains the list of processing which needs an impact assessment (section 21(4)) and publishes breach guidance and a reporting mechanism (section 22(6)). It prohibits, suspends or conditions transfers abroad (section 24(6)). It issues a warning, a formal notice with a deadline as short as five days in urgent cases, a limit on processing, a financial penalty, and, for a serious and immediate violation, a ban on processing (section 35). Its board of five is appointed by Parliament from ten candidates proposed by the Minister (section 28). Its funding comes partly from registration fees based on turnover and staff numbers (section 37).

A ten-step readiness plan

A practical programme does not need the final text. First, list every system holding personal data and who owns it. Second, write the record of processing (section 20): purposes, categories, recipients, time limits, security measures. Third, assign a lawful basis to each purpose and write down the balance test where legitimate interest is relied on. Fourth, review every consent screen against section 5: separate, specific, demonstrable, easy to withdraw. Fifth, set a retention period for each category and an owner who enforces it.

Sixth, write the access request procedure with a one month clock and a template reply. Seventh, write the breach procedure, with the 72 hour clock starting at first suspicion and a record of whether affected data was encrypted. Eighth, map transfers abroad and document the assessment of the receiving country’s protection (section 24). Ninth, check each processor contract for the five terms of section 18(4): instructions only, no sub-processor without written authorisation, help with audits, categories and purposes set out, and staff aware of security measures. Tenth, train front-line staff, because most breaches begin there.

Each step produces a document a regulator or customer would ask for, and each is worth doing under the stricter of the three regimes an organisation might face. A firm serving customers in South Africa or the European Union is already bound by POPIA or the GDPR and gains the Namibian readiness at little extra cost.

What this means for organisations in Namibia

Write a record of processing for each system holding personal data: purposes, categories of people and data, recipients, time limits and security measures. It is the first document a regulator or customer will ask for.

Prepare a breach procedure with a 72 hour clock which starts at first suspicion. Decide in advance who decides to notify, what the notice contains, and how encryption status is recorded, because the draft makes encryption central to whether people must be told.