VanuatuData Protection and Privacy Act 2024, enforcement powers and offences
Data Protection and Privacy Act No. 13 of 2024, ss. 18-30
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Deputy Commissioner of Data Protection and Privacy
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Provide a document or information the Deputy Commissioner requests in writing to determine whether the Act has been contravened, within 14 days of receiving the request.
- Do not destroy, conceal, alter or falsify personal data or other material to prevent its disclosure to a data subject or to the Deputy Commissioner.
- Expect a contravention of the Act to be punishable on conviction by a fine of up to VT10,000,000, with fines of VT1,000,000 or VT2,000,000 for hindering an enforcement power or unlawfully disclosing information obtained under a request or a search warrant.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Part 6 makes non-compliance with the Act, unlawful obtaining or disclosure of personal data, altering data to defeat a disclosure request, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner each an offence punishable on conviction by a fine of up to VT10,000,000; hindering the Deputy Commissioner's or a police officer's lawful exercise of powers draws a lesser fine of up to VT1,000,000, and unlawfully disclosing information, extracts, records or data obtained under a request or search warrant draws a fine of up to VT2,000,000. No provision states a term of imprisonment.
Penalty structure
Section 24's general non-compliance offence, and the specific offences at sections 25 to 28 (unlawful obtaining or disclosure of personal data, altering data to defeat disclosure, obstructing a search warrant, and destroying or falsifying information sought by the Deputy Commissioner), each cap the fine at VT10,000,000. Two lesser offences carry their own caps: section 29 (hindering or obstructing the Deputy Commissioner, a police officer, or a person assisting one) caps the fine at VT1,000,000, and section 30 (unlawfully disclosing information, records or data obtained under a request or search warrant) caps it at VT2,000,000. The Act states these amounts in Vanuatu vatu (VT).
- Rule
- Fixed only
- As of
- Currency
- VUV
- Fixed cap
- 10,000,000
What it makes you log
Logging duty
Section 18 lets the Deputy Commissioner require a data controller to provide a document or information that will assist in deciding whether the Act was breached, within 14 days; that is a demand power and names no record the controller must keep. Sections 19 to 23 are search warrants, sections 24 to 30 are offences (including section 26 on altering personal data and section 28 on destroying information the Deputy Commissioner requested), and none sets a record duty. Section 31(2)(e) lets regulations provide for a record of processing operations, but no such regulation is cited.
- Kind
- None
- As of
What this law does
Section 18 lets the Deputy Commissioner require a data controller in writing to provide a document or information that will assist in determining whether there has been a contravention of the Act, and requires the controller to comply within 14 days of receiving the request. Sections 19 to 23 provide for search warrants over premises, data centres and data servers, and their contents, extension and effect.
Section 24 makes a contravention of the Act an offence punishable on conviction by a fine of up to VT10,000,000, and sections 25 to 30 create further offences, including unlawfully obtaining or disclosing personal data, altering personal data to prevent its disclosure to a data subject, destroying, concealing or falsifying information the Deputy Commissioner has requested, and hindering or obstructing the lawful exercise of powers, with fines of VT1,000,000 or VT2,000,000 attaching to the lesser offences.
The Act was assented to on and commenced on , section 32 fixing commencement on the day of publication in the Gazette.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .