Processes personal data, in Vanuatu

Data Protection and Privacy Act No. 13 of 2024, ss. 15-17 · Read the law's page

• Do not transfer personal data generated or collected in Vanuatu outside the country without the Minister's prior authorisation, unless the recipient country or organisation is on the Minister's list of jurisdictions providing an appropriate level of protection, or the data subject's informed consent or another situation in section 17 applies.

Data Protection and Privacy Act No. 13 of 2024, ss. 18-30 · Read the law's page

• Provide a document or information the Deputy Commissioner requests in writing to determine whether the Act has been contravened, within 14 days of receiving the request.
• Do not destroy, conceal, alter or falsify personal data or other material to prevent its disclosure to a data subject or to the Deputy Commissioner.
• Expect a contravention of the Act to be punishable on conviction by a fine of up to VT10,000,000, with fines of VT1,000,000 or VT2,000,000 for hindering an enforcement power or unlawfully disclosing information obtained under a request or a search warrant.

Data Protection and Privacy Act No. 13 of 2024, ss. 2-5 and 8 · Read the law's page

• Do not process personal data unless it is processed fairly and transparently for an explicit, specified and legitimate purpose under one of the lawful purposes in section 5, such as the data subject's consent, contract necessity, a legal obligation, the public interest, or a legitimate interest that does not override the data subject's rights.
• Process personal data with reasonable and appropriate security measures against unauthorised or unlawful processing and against accidental or unauthorised access, destruction, loss, use, modification or disclosure.
• Keep personal data accurate, adequate and proportionate to the purpose, and for no longer than that purpose requires.
• Be able to demonstrate evidence of a data subject's consent, present any request for consent clearly and separately from other matters, obtain it for each specific purpose, and let the data subject withdraw it at any time, free of charge.

Data Protection and Privacy Act No. 13 of 2024, ss. 6-7 · Read the law's page

• Do not process special categories of personal data, including biometric data such as a voiceprint or facial image, genetic data, or data revealing racial or ethnic origin, political opinions, trade-union membership, religious belief, health or sexual life, unless an exception in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.
• Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put appropriate age-verification mechanisms in place, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.

Data Protection and Privacy Act No. 13 of 2024, ss. 9-12, 14 · Read the law's page

• On a data subject's request, provide confirmation of processing, a copy of their personal data, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month.
• On a data subject's request, correct or erase inaccurate, unlawfully processed or no longer necessary personal data, and restrict processing in the circumstances section 10 lists.
• Let a data subject object to the processing of their personal data.