VanuatuData Protection and Privacy Act 2024, transborder data flows
Data Protection and Privacy Act No. 13 of 2024, ss. 15-17
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data generated or collected in Vanuatu outside the country without the Minister's prior authorisation, unless the recipient country or organisation is on the Minister's list of jurisdictions providing an appropriate level of protection, or the data subject's informed consent or another situation in section 17 applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 15 to 17 require the Minister's prior authorisation for use of personal data generated or collected in Vanuatu elsewhere, list the countries with appropriate protection, allow safeguard procedures and set the specific situations for a transfer. They require no log or record of transfers, and name no retention period or audit. Section 15 reaches data generated or collected in Vanuatu; that is where the data arose and no hook value fits it, so none is coded.
- Kind
- None
- As of
What this law does
Section 15 provides that personal data generated or collected in Vanuatu must not be used elsewhere without the Minister's prior authorisation, section 16 requires safeguards before a transfer outside Vanuatu, including that the recipient country or organisation appears on the Minister's list of jurisdictions providing an appropriate level of protection, and section 17 allows a cross-border transfer in the specific situations it lists, including the data subject's informed consent.
The Act was assented to on and commenced on , section 32 fixing commencement on the day of publication in the Gazette.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .