LexLint.ioBeta

Know the law your code answers to.

Law / Vanuatu

Data Protection and Privacy Act 2024, rights of the data subject

Data Protection and Privacy Act No. 13 of 2024, ss. 9-12, 14

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Disclosure, Data subject rights
Audit expectation
none

What it requires

  • On a data subject's request, provide confirmation of processing, a copy of their personal data, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month.NIST Privacy FrameworkCT.DM-P1
  • On a data subject's request, correct or erase inaccurate, unlawfully processed or no longer necessary personal data, and restrict processing in the circumstances section 10 lists.NIST Privacy FrameworkCT.PO-P3
  • Let a data subject object to the processing of their personal data.NIST Privacy FrameworkCT.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Sections 9 to 12 and 14 set the access, restriction, rectification, erasure and objection rights and the one-month response period. They require no log or record. The burden of proving a request excessive (section 9(4)) and the controller's showing of overriding grounds against an objection (section 12) allocate proof in a request dispute and name no record to keep. Section 9(1)(c)(v) has the controller tell the data subject the retention period of the personal data, which limits the data, not a record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 9 requires a data controller to let a data subject obtain, on request, confirmation that their personal data is being processed, a copy of it, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month, with a reasonable administrative fee or a refusal available only where the request is excessive or unreasonable and the controller bears the burden of proving that.

Section 10 allows a data subject to have processing restricted in the circumstances it lists, section 11 requires inaccurate, unlawfully processed or no longer necessary personal data to be corrected or erased, section 12 gives a right to object to processing, and section 14 provides for representation of the data subject. The Act was assented to on and commenced on , section 32 fixing commencement on the day of publication in the Gazette.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .