Data Protection and Privacy Act 2024, comprehensive personal data protection regime

Data Protection and Privacy Act No. 13 of 2024 (Vanuatu)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 2 January 2025.

A comprehensive regime rule binding public and private bodies.

As of 6 September 2026.

What it requires

Do not process personal data unless it is processed fairly and transparently for an explicit, specified and legitimate purpose under one of the lawful bases in section 5, such as the data subject's consent, contract necessity, a legal obligation, the public interest, or a legitimate interest that does not override the data subject's rights.
Do not process special categories of personal data, including biometric data such as a voiceprint or facial image, genetic data, or data revealing racial or ethnic origin, political opinions, trade-union membership, religious belief, health or sexual life, unless a section 6(2) exception applies, such as the data subject's consent or a safeguarded public-interest ground.
Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put in place appropriate mechanisms for age verification, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.
Be able to demonstrate evidence of a data subject's consent, present any request for consent clearly and separately from other matters, and let the data subject withdraw consent at any time, free of charge.
On a data subject's request, provide confirmation of processing, a copy of their personal data, and information on the purposes, source, recipients, retention period and any planned overseas transfer, in writing, in plain language, free of charge and within one month.
On a data subject's request, correct or erase inaccurate, unlawfully processed, or no-longer-necessary personal data without delay and free of charge, restrict processing in specified circumstances, and let the data subject object to processing or avoid a decision based solely on automated processing, including profiling, that significantly affects them.
Process personal data with reasonable and appropriate security measures against unauthorised or unlawful processing and against accidental or unauthorised access, destruction, loss, use, modification or disclosure.
Do not transfer personal data generated or collected in Vanuatu outside the country without the Minister's prior authorisation, unless the recipient country or organisation is on the Minister's list of jurisdictions providing an appropriate level of protection, or the data subject's informed consent or another section 17 exception applies.
Comply within 14 days with a Deputy Commissioner's written request for a document or information needed to determine whether this Act has been breached, and do not destroy, conceal, alter or falsify personal data or other material to prevent its disclosure to a data subject or the Deputy Commissioner.
A contravention of this Act is punishable on conviction by a fine of up to VT10,000,000, with lesser fines of VT1,000,000 or VT2,000,000 attaching to hindering an enforcement power or unlawfully disclosing information obtained under a request or search warrant.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Part 6 makes non-compliance with the Act, unlawful obtaining or disclosure of personal data, altering data to defeat a disclosure request, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner each an offence punishable on conviction by a fine of up to VT10,000,000; hindering the Deputy Commissioner's or a police officer's lawful exercise of powers draws a lesser fine of up to VT1,000,000, and unlawfully disclosing information, extracts, records or data obtained under a request or search warrant draws a fine of up to VT2,000,000. No provision states a term of imprisonment.

Penalty structure

Section 24's general non-compliance offence, and the specific offences at sections 25 to 28 (unlawful obtaining or disclosure of personal data, altering data to defeat disclosure, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner), each cap the fine at VT10,000,000. Two lesser offences carry their own caps: section 29 (hindering or obstructing the Deputy Commissioner, a police officer, or a person assisting one) caps the fine at VT1,000,000, and section 30 (unlawfully disclosing information, records or data obtained under a request or search warrant) caps it at VT2,000,000. The Act states these amounts in Vanuatu vatu (VT).

Rule: Fixed only
As of: 6 September 2026
Currency: VUV
Fixed cap: 10,000,000

Who enforces it

Enforcement body

Deputy Commissioner of Data Protection and Privacy

What it reaches

Obligation class

Consent, Disclosure, Data subject rights, Transfer, Security, Governance, Biometric, Age verification, Retention

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 2 applies the Act to processing of personal data in the private and public sectors, wherever the data subject resides, where the processing takes place in Vanuatu, involves data generated or collected in Vanuatu, or targets or monitors a person in Vanuatu, but excludes purely personal or household processing.

Section 4 requires personal data to be processed fairly, transparently, for explicit and legitimate purposes, adequately and proportionately, accurately, for no longer than necessary, and with appropriate security, and section 5 lists the lawful bases for processing, including consent, contract necessity, legal obligation, public interest, and a legitimate interest that does not override the data subject's rights.

Section 6 prohibits processing special categories of personal data, defined in section 1 to include genetic data, biometric data uniquely identifying a person, and data revealing racial or ethnic origin, political opinions, trade-union membership, religious belief, health or sexual life, unless a listed exception applies, such as consent, an employment or social-security purpose, medical care, public health, or a safeguarded charitable-body purpose.

Section 7 prohibits processing a child's personal data unless a parent, carer or legal representative has consented, the processing is in the child's legitimate interest, meets a legal obligation, serves the public interest, or is necessary for preventive or counselling services offered directly to the child, and requires that communication addressed to a child use clear, plain language with appropriate mechanisms for age verification in place.

Section 8 requires that consent be demonstrable, freely given, presented separately from other matters in plain language, and withdrawable at any time free of charge.

Sections 9 to 14 give a data subject the right to access their personal data and related information within one month and free of charge, to restrict processing in specified circumstances, to have inaccurate or unlawfully processed data rectified or erased, to object to processing, and not to be subject to a decision based solely on automated processing, including profiling, that significantly affects them, unless the decision is authorised by law, necessary for a contract, or consented to with safeguards including human intervention.

Sections 15 to 17 bar transferring personal data generated or collected in Vanuatu outside the country without the Minister's prior authorisation, unless the recipient country or organisation is on a Minister-published list of jurisdictions providing an appropriate level of protection, or a specific exception such as the data subject's informed consent applies.

Part 5 gives the Deputy Commissioner powers to compel disclosure of documents or information within 14 days and to obtain a Court-issued search warrant to access, seize or secure a data centre or data server, and Part 6 makes non-compliance with the Act, unlawful obtaining or disclosure of personal data, altering data to defeat a disclosure request, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner each an offence punishable by a fine of up to VT10,000,000, with lesser fines of VT1,000,000 for hindering the Deputy Commissioner's powers and VT2,000,000 for unlawfully disclosing information obtained under a request or warrant.

Section 31 lets the Minister make Regulations on matters including joint-controller obligations, processor obligations, security of processing, records of processing, and personal-data-breach obligations and notification, none of which the Act itself yet states as a standing duty, and section 32 commenced the Act on the day of its Gazette publication.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
processes_biometrics
processes_voice
serves_minors

Read the law

Official text of the Data Protection and Privacy Act No. 13 of 2024, Vanuatu Department of Communications and Digital Transformation

Back to the example · Lint your app