Cybersecurity law & regulation in Vanuatu (2026)

Legal framework

Vanuatu has no single NIS2-style comprehensive cybersecurity statute. Obligations are spread across the Cybercrime Act No. 22 of 2021 (criminal), the Data Protection and Privacy Act No. 13 of 2024 (security and breach-notification duties for personal data), and the National Cyber Security Strategy 2030, with CERT VU (under OGCIO) as the operational incident-response hub.

Key points: cybersecurity in Vanuatu

1. 01Cybercrime Act 2021

   The Cybercrime Act No. 22 of 2021 (in force 22 September 2021) is Vanuatu's flagship cyber law, criminalising offences against the confidentiality, integrity and availability of computer data and systems; it was drafted with Council of Europe GLACY+ support to align with the Budapest Convention.

   ogcio.gov.vu paclii.org

2. 02Data protection security & breach notification

   The Data Protection and Privacy Act No. 13 of 2024 (effective 2 January 2025) requires reasonable and appropriate security measures, data protection impact assessments for high-risk processing, and data-breach notification, making breach reporting a legal duty for personal-data controllers.

   digital.gov.vu dataguidance.com

3. 03Oversight authority

   Enforcement of data-protection/security obligations sits with a Commissioner of Data Protection and Privacy, established alongside the Digital Safety Authority framework introduced in 2024.

   parliament.gov.vu parliament.gov.vu

4. 04National Cyber Security Strategy 2030

   The NCSS 2030 is a non-binding policy aimed at improving the security and resilience of Vanuatu's national critical infrastructure through six national priorities; it sets objectives rather than enforceable obligations.

   cert.gov.vu cert.gov.vu

5. 05CERT Vanuatu incident reporting

   CERT VU, a unit within the Office of the Government Chief Information Officer, is the central cyber incident-response hub; reporting is via a voluntary online form/email rather than a statutory mandatory-reporting obligation.

   cert.gov.vu cert.gov.vu

6. 06Financial-sector supervision

   Banks and authorised financial institutions licensed under the Financial Institutions Act are supervised by the Reserve Bank of Vanuatu, which can issue prudential guidelines affecting handling and security of customer information.

   rbv.gov.vu

Sources

1. 1.ogcio.gov.vu/images/Docs/legislation/Cybercrime_Act_n_of_2021.pdf
2. 2.paclii.org/vu/legis/num_act/ca2021112.pdf
3. 3.digital.gov.vu/images/Docs/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-
4. 4.parliament.gov.vu/images/Bill_for_the_Data_Protection_and_Privacy_Act_No._of_2024.pdf
5. 5.parliament.gov.vu/images/Bill_for_the_Digital_Safety_Authority_Act_No._of_2024.pdf
6. 6.cert.gov.vu/images/ressources/Vanuatu_National_CyberSecurity_Strategy2030_Booklet
7. 7.cert.gov.vu/index.php/report-incident
8. 8.cert.gov.vu/index.php/about
9. 9.rbv.gov.vu/index.php/en/financial-stability/authorised-banks-supervised-financia
10. 10.coe.int/en/web/octopus/-/vanuatu
11. 11.dataguidance.com/jurisdiction/vanuatu
12. 12.cert.gov.vu/index.php/policies-strategies/56-vanuatu-s-national-cyber-security-st