Skip to content
World Watch

Data protection & privacy law in Vanuatu (2026)

Data protection in Vanuatu: comprehensive law.

Vanuatu has a comprehensive, GDPR/Convention 108+-style data protection regime under the Data Protection and Privacy Act No. 13 of 2024, which came into effect on 2 January 2025 and applies to both public and private sectors. It was developed with Council of Europe support following the 2023 National Data Protection and Privacy Policy, and is enforced by a dedicated Commissioner of Data Protection and Privacy operating within the Digital Safety Authority. The regime grants data-subject rights, imposes controller/processor obligations, and regulates cross-border transfers.

Last verified Official sources first · MethodologyCompare Vanuatu with other countries

Legal framework

Data Protection and Privacy Act No. 13 of 2024 (in force 2 January 2025), supervised by the Commissioner/Deputy Commissioner of Data Protection and Privacy under the Digital Safety Authority Act No. 15 of 2024.

Key points: data & privacy in Vanuatu

  1. Comprehensive in-force law

    The Data Protection and Privacy Act No. 13 of 2024 entered into force on 2 January 2025 and applies across both the public and private sectors, replacing reliance on only the constitutional privacy guarantee (Article 5).

    digital.gov.vu dataguidance.com

  2. Supervisory authority

    Enforcement sits with a Commissioner / Deputy Commissioner of Data Protection and Privacy, appointed in connection with the Digital Safety Authority Act No. 15 of 2024; the authority can investigate, audit, and impose penalties and corrective measures.

    paclii.org dataguidance.com

  3. International alignment

    The law was drafted with technical support from the Council of Europe and is designed to align with Convention 108+ and the EU GDPR, building on the 2023 National Data Protection and Privacy Policy.

    coe.int digital.gov.vu

  4. Special categories and children's data

    Processing of special categories of personal data is prohibited (subject to exceptions), and the processing of a child's personal data is specifically restricted/prohibited under the Act.

    dataguidance.com digital.gov.vu

  5. Data-subject rights

    The Act provides rights including the right to object to processing and the right not to be subject to solely automated decision-making, reflecting GDPR-style protections.

    dataguidance.com digital.gov.vu

  6. Cross-border transfers and penalties

    The Act regulates transborder data flows, requiring safeguards before personal data is transferred outside Vanuatu, and establishes financial penalties for non-compliance (figures such as VT10,000,000 are referenced).

    digital.gov.vu dataguidance.com

Sources

  1. digital.gov.vu/images/Docs/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-
  2. parliament.gov.vu/images/Bills%20for%202024%20Second%20ordinary/Data%20Protection/Bill%
  3. paclii.org/vu/legis/num_act/dsaa2024274.pdf
  4. coe.int/en/web/data-protection/vanatu-support-to-the-development-of-data-prot
  5. digital.gov.vu/images/policies/DPPP_interactive_pdf_eng.pdf
  6. cert.gov.vu/index.php/policies-strategies/54-vanuatu-national-data-protection-pri
  7. dataguidance.com/jurisdiction/vanuatu

Next for Vanuatu: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026