Data Protection and Privacy Act 2024, special categories and children's personal data

Data Protection and Privacy Act No. 13 of 2024, ss. 6-7

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 2 January 2025.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process special categories of personal data, including biometric data such as a voiceprint or facial image, genetic data, or data revealing racial or ethnic origin, political opinions, trade-union membership, religious belief, health or sexual life, unless an exception in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.
Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put appropriate age-verification mechanisms in place, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.

What it reaches

Obligation class

Consent, Biometric, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 6 prohibits the processing of special categories of personal data, which section 1 defines to include biometric data resulting from specific technical processing, genetic data, and personal data relating to racial or ethnic origin, political opinions, trade-union membership, religious or philosophical belief, health and sexual life, unless one of the exceptions in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.

Section 7 requires the consent of a parent, carer or legal guardian before a child's or other vulnerable individual's personal data is processed, communication with the child in clear and plain language, and appropriate mechanisms for age verification, except where the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Read the law

Official text of the Data Protection and Privacy Act No. 13 of 2024, Vanuatu Department of Communications and Digital Transformation

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app