Data Protection and Privacy Act 2024, rights of the data subject

Data Protection and Privacy Act No. 13 of 2024, ss. 9-14

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 2 January 2025.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

On a data subject's request, provide confirmation of processing, a copy of their personal data, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month.
On a data subject's request, correct or erase inaccurate, unlawfully processed or no longer necessary personal data, and restrict processing in the circumstances section 10 lists.
Let a data subject object to the processing of their personal data, and do not subject them to a decision based solely on automated processing, including profiling.

What it reaches

Obligation class

Disclosure, Data subject rights

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 9 requires a data controller to let a data subject obtain, on request, confirmation that their personal data is being processed, a copy of it, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month, with a reasonable administrative fee or a refusal available only where the request is excessive or unreasonable and the controller bears the burden of proving that.

Section 10 allows a data subject to have processing restricted in the circumstances it lists, section 11 requires inaccurate, unlawfully processed or no longer necessary personal data to be corrected or erased, section 12 gives a right to object to processing, section 13 gives a right not to be subject to a decision based solely on automated processing, including profiling, and section 14 provides for representation of the data subject.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

When LexLint raises it

high_risk_decisions
automated_outreach
deploys_chatbot
crawls_web
trains_models

Read the law

Official text of the Data Protection and Privacy Act No. 13 of 2024, Vanuatu Department of Communications and Digital Transformation

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app