Data Protection and Privacy Act 2024, comprehensive personal data protection regime

Data Protection and Privacy Act No. 13 of 2024, ss. 2-5 and 8

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 2 January 2025.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process personal data unless it is processed fairly and transparently for an explicit, specified and legitimate purpose under one of the lawful purposes in section 5, such as the data subject's consent, contract necessity, a legal obligation, the public interest, or a legitimate interest that does not override the data subject's rights.
Process personal data with reasonable and appropriate security measures against unauthorised or unlawful processing and against accidental or unauthorised access, destruction, loss, use, modification or disclosure.
Keep personal data accurate, adequate and proportionate to the purpose, and for no longer than that purpose requires.
Be able to demonstrate evidence of a data subject's consent, present any request for consent clearly and separately from other matters, obtain it for each specific purpose, and let the data subject withdraw it at any time, free of charge.

What it reaches

Obligation class

Consent, Disclosure, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 2 applies the Act to the processing of personal data in the private and public sectors, wherever the data subject resides, where the processing takes place in Vanuatu, involves data generated or collected in Vanuatu, or targets or monitors a person in Vanuatu, and excludes purely personal or household processing.

Section 4 requires personal data to be processed fairly and transparently, for an explicit, specified and legitimate purpose, adequately and proportionately, accurately, for no longer than necessary, and with reasonable and appropriate security measures against unauthorised or unlawful processing and against accidental or unauthorised access, destruction, loss, use, modification or disclosure.

Section 5 lists the lawful purposes for processing, including the data subject's consent, the performance of a contract, a legal obligation, the public interest, and a legitimate interest that does not override the data subject's rights. Section 8 governs consent: it must be demonstrable, presented clearly and separately from other matters, given for each specific purpose, and withdrawable at any time free of charge.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Official text of the Data Protection and Privacy Act No. 13 of 2024, Vanuatu Department of Communications and Digital Transformation

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app