VanuatuCybercrime Act 2021, computer-access and interference offences
Cybercrime Act No. 22 of 2021 (Vanuatu)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.paclii.org/vu/legis/num_act/ca2021112.pdfIn force since .
A computer misuse rule binding public and private bodies.
- Enforcement body
- Vanuatu Police Force, through an authorised officer appointed under section 69
- Obligation class
- Access restriction, Prohibition
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not access the whole or part of a computer system by infringing a security measure, whether or not the underlying data is later used for crawling or training, unless entitled to access it or the owner has consented.NIST AI RMFMAP 4.1
- Do not intercept a non-public transmission of computer data to, from or within a computer system, or the electromagnetic emission of such a system, without lawful excuse.NIST AI RMFMAP 4.1
- Do not do any act that causes unauthorised interference to a computer system, program or data; the fine and prison term rise sharply where the interference causes a financial loss over VT1,000,000, threatens national security or public health or safety, or causes physical injury or death.no control in the NIST AI RMF
- Do not produce, sell, import, export, distribute or make available software, a device, a password or an access code for the purpose of unauthorised interception or interference with a computer system, except for authorised training, testing or protection of a computer system.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Every offence in Part 2 (illegal access, illegal interception, unauthorised interference, misuse of devices) is punishable on conviction by a fine and, for an individual, imprisonment; the fine and prison term scale with the offence, peaking at a fine of up to VT50,000,000 or up to 50 years' imprisonment for an individual (VT100,000,000 for a body corporate) where unauthorised interference causes serious harm under section 5(3).
Penalty structure
Section 3 (illegal access) and section 4 (illegal interception) each cap an individual's fine at VT2,000,000 (up to 5 years' imprisonment) and a body corporate's at VT4,000,000. Section 5 (unauthorised interference) caps an individual's fine at VT7,000,000 (up to 40 years' imprisonment) and a body corporate's at VT100,000,000 for ordinary unauthorised interference, rising to VT50,000,000 (up to 50 years) for an individual where section 5(3)'s serious-harm threshold is met, with the body-corporate cap unchanged at VT100,000,000; reckless interference under section 5(4) caps an individual's fine at VT10,000,000 (up to 40 years) with the same VT100,000,000 body-corporate cap. Section 6 (misuse of devices) caps an individual's fine at VT1,000,000 (up to 3 years) and a body corporate's at VT3,000,000. The Act states these amounts in Vanuatu vatu (VT).
- Rule
- Fixed only
- As of
- Currency
- VUV
- Fixed cap
- 100,000,000
What it makes you log
Who may demand the log
Regulator
Logging duty
The Act imposes no standing record or retention duty on a service provider. Section 18 lets the Court, on the Commissioner's application, order a provider to preserve specified computer data, including traffic data, for the period the order states (at most 90 days, extendable once by 90 days under s. 18(4) and (5)); section 22 lets the Commissioner request records of traffic data already in existence; section 60 provides preservation of at least 60 days on a foreign request. These are demand powers over data a provider already holds, so the record question is answered by the audit and access keys, and no retention period is stated for a record the provider must keep.
- Kind
- None
- As of
- Provision
- Cybercrime Act No. 22 of 2021, s. 18 (a service provider served with a court preservation order must keep the specified computer data, including traffic data or content data, for the period stated, at most 90 days), with s. 22 (disclosure of records of traffic data on the Commissioner's request)
What this law does
Section 3 makes it an offence to intentionally and without lawful excuse access the whole or part of a computer system by infringing a security measure, punishable by a fine of up to VT2,000,000 or up to 5 years' imprisonment for an individual, or a fine of up to VT4,000,000 for a body corporate; a person is not liable if entitled to access the program or data or has consent to it. Section 4 similarly bars intercepting a non-public transmission of computer data without lawful excuse.
Section 5 makes unauthorised interference with a computer system, program or data an offence carrying a fine of up to VT7,000,000 or up to 40 years' imprisonment for an individual (up to VT100,000,000 for a body corporate), rising to a fine of up to VT50,000,000 or up to 50 years' imprisonment where the interference causes serious harm such as a financial loss over VT1,000,000, a threat to national security, physical injury or death, or a threat to public health or safety, and a lesser fine of up to VT10,000,000 or up to 40 years' imprisonment for reckless interference.
Section 6 makes it an offence, carrying a fine of up to VT1,000,000 or up to 3 years' imprisonment for an individual (up to VT3,000,000 for a body corporate), to produce, sell, procure, import, export, distribute or make available software, a device, or an access code for the purpose of unauthorised interception or interference, unless the act is for authorised training, testing or protection of a computer system.
Section 63, in the Act's mutual-assistance part, confirms that a police officer may access publicly available stored computer data without authorisation regardless of where it is geographically located, consistent with section 3's security-measure-based test for what counts as unauthorised access.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .