Cybersecurity regulation in Vanuatu (2026)

The Cybercrime Act No. 22 of 2021 (in force 22 September 2021) is Vanuatu's flagship cyber law, criminalising offences against the confidentiality, integrity and availability of computer data and systems; it was drafted with Council of Europe GLACY+ support to align with the Budapest Convention.

The Data Protection and Privacy Act No. 13 of 2024 (effective 2 January 2025) requires reasonable and appropriate security measures, data protection impact assessments for high-risk processing, and data-breach notification — making breach reporting a legal duty for personal-data controllers.

Enforcement of data-protection/security obligations sits with a Commissioner of Data Protection and Privacy, established alongside the Digital Safety Authority framework introduced in 2024.

The NCSS 2030 is a non-binding policy aimed at improving the security and resilience of Vanuatu's national critical infrastructure through six national priorities; it sets objectives rather than enforceable obligations.

CERT VU, a unit within the Office of the Government Chief Information Officer, is the central cyber incident-response hub; reporting is via a voluntary online form/email rather than a statutory mandatory-reporting obligation.

Banks and authorised financial institutions licensed under the Financial Institutions Act are supervised by the Reserve Bank of Vanuatu, which can issue prudential guidelines affecting handling and security of customer information.