Namibia's Data Protection Bill: What It Means for Your Website

Where Namibia's Data Protection Bill Stands (October 2026)

Today there is no single Act in force in Namibia that comprehensively regulates personal data. Article 13 of the Namibian Constitution protects the right to privacy, but there is no data protection regulator and no detailed set of rules for businesses.

The Ministry of Information and Communication Technology has been preparing a Data Protection Bill for several years. A revised draft was published for public comment in 2022, and in August 2025 the Minister said the Bill was in its final stages.

As of 20 October 2026, the National Assembly's Order Paper lists, under notices of motions, the Minister's motion for leave to introduce the Bill. The same motion already appeared on the Order Paper of 10 September 2026. In other words, the Bill is ready to be tabled, but it has not yet been formally introduced or debated.

Before it becomes law, it still has to pass the National Assembly and be reviewed by the National Council, be signed by the President and be published in the Government Gazette — and its commencement date may be set separately. Timelines have slipped before, so treat any predicted date with caution.

What the Bill Will Cover

The motion on the Order Paper describes the Bill's scope. It would:

• establish a Data Protection Supervisory Authority and provide for a Data Protection Commissioner;
• set out the obligations of data controllers, data processors and third parties — the organisations that decide how personal data is used, and the service providers that handle it for them;
• regulate the processing of information about individuals to protect their right to privacy;
• provide for the governance of data centres and “sovereign data”, including principles for the hosting, classification, location, storage and transfer of, and access to, personal data within and outside Namibia;
• set out the rights of individuals whose information is processed;
• provide for codes of conduct, restrictions and exceptions, and sanctions for breaches and non-compliance.

The data-hosting element stands out. It means the question “where are our website and customer data stored?” is likely to matter legally, not just technically.

Key Principles in the Latest Published Draft

The final text has not been published, so details may change. The most recent draft released for public comment (2022) is still the best guide to what to expect. It required personal data to be:

• processed lawfully and reasonably, on a recognised basis such as consent, a contract, a legal obligation or legitimate interests;
• adequate, relevant and not excessive for its purpose;
• collected for a specific purpose, with any further use compatible with that purpose;
• kept no longer than necessary;
• protected by appropriate security measures, including when a service provider processes it on your behalf.

The 2022 draft also:

• required organisations to tell people, when collecting their data, what is collected, why, whether providing it is voluntary and whether it will be sent to another country;
• required the Authority and the people affected to be notified of a security compromise as soon as reasonably possible — for example by email or a prominent notice on the website;
• gave people the right to ask whether an organisation holds their data, to receive a copy or description of it and to request its correction or deletion;
• restricted the processing of children's personal data without the consent of a parent or other competent person;
• restricted transfers of personal data to other countries unless the recipient offers an adequate level of protection or another exception applies, such as the person's consent;
• gave organisations one year after commencement to bring their processing into line, a period the Minister could extend.

What About POPIA?

Many Namibians search for “POPIA Namibia”. POPIA is South Africa's Protection of Personal Information Act, not a Namibian law. It applies to organisations domiciled in South Africa, and to organisations elsewhere that use automated or non-automated means in South Africa to process personal information — unless those means are only used to forward information through the country.

A Namibian business with a South African branch, or one that processes personal information using means in South Africa, may therefore have POPIA obligations. In the same way, the European Union's GDPR can apply to businesses outside Europe that offer goods or services to people in the EU. If either situation applies to you, take legal advice.

Get Your Website Ready Now: A Practical Checklist

You do not need to wait for the final Act. These steps reflect good practice under every modern data protection law and will put you in a strong position when Namibia's law commences.

1. Map your data. List every place your website collects personal information: contact and quote forms, newsletter sign-ups, shop orders, client portals, analytics and chat widgets.
2. Publish a clear privacy notice. Explain what you collect, why, how long you keep it, who you share it with and how people can reach you, and link to it from every form. Our own privacy policy is an example of the plain-language approach.
3. Collect less. Remove form fields you do not genuinely need. Less data means less risk.
4. Ask for consent properly. Use an unticked checkbox for marketing emails and keep a record of when consent was given.
5. Audit cookies and third-party scripts. Tracking pixels, embedded videos and chat tools can send visitor data to other companies. Keep only what you need and name the rest in your privacy notice.
6. Secure the website. HTTPS everywhere, up-to-date software, strong passwords with two-factor sign-in, and regular, tested backups.
7. Know where your data is stored. Ask your hosting, email and software providers where their servers and backups are, and put a written agreement in place with each of them.
8. Prepare a breach plan. Decide who investigates an incident, who decides whether to notify, and how you would contact the people affected.
9. Be ready for access requests. Make sure you can find, export, correct and delete one person's data on request.
10. Set retention periods. Delete old form submissions and inactive accounts on a schedule.

Why Your Hosting Choices Will Matter

Because the Bill also covers data centres and the location of data, your choice of providers becomes part of your compliance. Your website, its form submissions, your business email and your shared files may each sit with a different company in a different country.

The practical answer is to keep the list of providers short and the answers clear: know who hosts what, where, and under which agreement. Platforms you can run with a provider you know — for example Nextcloud instead of a global cloud suite — make those answers easier to give. Email deserves the same attention: properly authenticated email protects both your customers and your reputation, as we explain in why emails end up in spam.

Schools have extra reason to act early, because learner records are children's data. Our school management system guide covers the questions to ask about hosting and access.

A Note on Legal Advice

This article summarises publicly available information as of 20 October 2026 for general guidance only. It is not legal advice. The final Act may differ from the draft described here, so confirm your obligations with a qualified legal practitioner once the law is passed — and watch the National Assembly's Order Papers and the Government Gazette for progress.