Data protection & privacy laws in Vanuatu (2026)

The Data Protection and Privacy Act No. 13 of 2024 entered into force on 2 January 2025 and applies across both the public and private sectors, replacing reliance on only the constitutional privacy guarantee (Article 5).

Enforcement sits with a Commissioner / Deputy Commissioner of Data Protection and Privacy, appointed in connection with the Digital Safety Authority Act No. 15 of 2024; the authority can investigate, audit, and impose penalties and corrective measures.

The law was drafted with technical support from the Council of Europe and is designed to align with Convention 108+ and the EU GDPR, building on the 2023 National Data Protection and Privacy Policy.

Processing of special categories of personal data is prohibited (subject to exceptions), and the processing of a child's personal data is specifically restricted/prohibited under the Act.

The Act provides rights including the right to object to processing and the right not to be subject to solely automated decision-making, reflecting GDPR-style protections.

The Act regulates transborder data flows, requiring safeguards before personal data is transferred outside Vanuatu, and establishes financial penalties for non-compliance (figures such as VT10,000,000 are referenced).