Data protection & privacy law in Fiji (2026)

Fiji's Cabinet approved a comprehensive national policy framework for privacy and personal data protection — the clearest governmental signal yet that standalone data-protection legislation is imminent. The policy establishes overarching principles and governance expectations ahead of a forthcoming Privacy Bill.

Fiji's Ministry of Communications released its first-ever National Digital Strategy, mandating strong cybersecurity practices for businesses and targeting 80% of key government services online by 2030. Data governance and a national digital identity framework are central pillars, framing the environment into which future data-protection rules will fit.

The FLRC published a Discussion Paper proposing reforms to the Information Act 2018 and the creation of an Accountability and Transparency Commission, directly affecting how personal data held by public agencies may be accessed, corrected, or withheld. This review may reshape the only current quasi-subject-access-request mechanism in Fijian law.

The government published a dedicated cybersecurity blueprint covering critical-infrastructure protection, incident response, and data-security governance. It explicitly incorporates plans for an AI governance framework and a National AI Policy, extending data-protection considerations into emerging technologies.

Fiji deposited its instrument of accession to the Council of Europe's Convention on Cybercrime (Budapest Convention) in Strasbourg, committing to harmonised standards on data-related offences, cross-border digital-evidence sharing, and procedural safeguards for personal data used in criminal investigations.

The operative provisions of the Cybercrime Act 2021 (Act No. 3 of 2021) took effect, criminalising unauthorised access, data interference, and interception of electronic communications, and requiring judicial authorisation for data searches and seizures. It became Fiji's primary instrument for protecting data held in computer systems.

Parliament passed Act No. 3 of 2021 after a reform process begun in 2019, criminalising offences against the confidentiality, integrity, and availability of computer data and systems. The Act defines 'computer data' broadly enough to cover personal data, and includes extensive mutual-legal-assistance provisions for cross-border data investigations.

Act No. 8 of 2018 established the Online Safety Commission to receive complaints about harmful electronic communications, including non-consensual sharing of intimate images and targeted online harassment. It created Fiji's first dedicated mechanism to redress the privacy-invasive misuse of personal information online, though it drew criticism for potential overreach into lawful speech.

Act No. 9 of 2018 operationalised the constitutional right of access to information held by public agencies, including a right to access and seek correction of one's own personal data held by government. Section 6 functions as Fiji's closest current equivalent to a statutory subject-access right, in the absence of a standalone privacy law.

The 2013 Constitution embedded in Section 24 a justiciable right to personal privacy, explicitly covering confidentiality of personal information and communications, and respect for private and family life. This provision remains the foundational legal basis for all privacy protection in Fiji and the primary reference point for courts in the absence of a general data-protection statute.

Section 54(1)(e) of the Telecommunications Promulgation (later renamed the Telecommunications Act 2008) requires all licensed providers to keep consumer billing and call data strictly confidential, enforceable by the Telecommunications Authority of Fiji (TAF). It remains one of the few sector-specific data-privacy mandates with a dedicated regulator and active consumer-protection programme.

The Banking Act 1995 imposed legally enforceable confidentiality obligations on licensed banks regarding customer information, establishing one of Fiji's earliest sector-specific data-privacy requirements. Together with the 1998 Fiji Revenue and Customs Service Act, it laid the groundwork for the fragmented, sector-by-sector approach to data confidentiality that persists to this day.