VanuatuData Protection and Privacy Act 2024, enforcement powers and offences
Data Protection and Privacy Act No. 13 of 2024, ss. 18-30
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 2 January 2025.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Provide a document or information the Deputy Commissioner requests in writing to determine whether the Act has been contravened, within 14 days of receiving the request.
- Do not destroy, conceal, alter or falsify personal data or other material to prevent its disclosure to a data subject or to the Deputy Commissioner.
- Expect a contravention of the Act to be punishable on conviction by a fine of up to VT10,000,000, with fines of VT1,000,000 or VT2,000,000 for hindering an enforcement power or unlawfully disclosing information obtained under a request or a search warrant.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Part 6 makes non-compliance with the Act, unlawful obtaining or disclosure of personal data, altering data to defeat a disclosure request, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner each an offence punishable on conviction by a fine of up to VT10,000,000; hindering the Deputy Commissioner's or a police officer's lawful exercise of powers draws a lesser fine of up to VT1,000,000, and unlawfully disclosing information, extracts, records or data obtained under a request or search warrant draws a fine of up to VT2,000,000. No provision states a term of imprisonment.
Penalty structure
Section 24's general non-compliance offence, and the specific offences at sections 25 to 28 (unlawful obtaining or disclosure of personal data, altering data to defeat disclosure, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner), each cap the fine at VT10,000,000. Two lesser offences carry their own caps: section 29 (hindering or obstructing the Deputy Commissioner, a police officer, or a person assisting one) caps the fine at VT1,000,000, and section 30 (unlawfully disclosing information, records or data obtained under a request or search warrant) caps it at VT2,000,000. The Act states these amounts in Vanuatu vatu (VT).
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- VUV
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Deputy Commissioner of Data Protection and Privacy
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 18 lets the Deputy Commissioner require a data controller in writing to provide a document or information that will assist in determining whether there has been a contravention of the Act, and requires the controller to comply within 14 days of receiving the request. Sections 19 to 23 provide for search warrants over premises, data centres and data servers, and their contents, extension and effect.
Section 24 makes a contravention of the Act an offence punishable on conviction by a fine of up to VT10,000,000, and sections 25 to 30 create further offences, including unlawfully obtaining or disclosing personal data, altering personal data to prevent its disclosure to a data subject, destroying, concealing or falsifying information the Deputy Commissioner has requested, and hindering or obstructing the lawful exercise of powers, with fines of VT1,000,000 or VT2,000,000 attaching to the lesser offences.
The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometrics
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.