Vanuatu

Section 13 lists an "artificial intelligence (AI) and AI-related data services permit" as one of thirteen classes of ICT service permit, alongside classes such as cloud and data services, e-commerce, and cybersecurity governance.

Section 14 requires a person who intends to carry on business as an ICT service provider, including one offering AI or AI-related data services, to apply to the Director for the corresponding permit, which section 17 makes valid for one year and renewable, and section 18 requires an annual permit fee.

The Director may impose, vary, suspend, or cancel a permit's conditions under sections 16, 19, and 20 for breach of a condition or of the Act or its Regulations, and section 31(1) makes carrying out an ICT activity, including providing AI or AI-related data services, without a valid permit an offence punishable on conviction by a fine of up to VT3,000,000 or up to 3 years' imprisonment for an individual, or a fine of up to VT20,000,000 for a body corporate.

Section 2 applies the Act to the processing of personal data in the private and public sectors, wherever the data subject resides, where the processing takes place in Vanuatu, involves data generated or collected in Vanuatu, or targets or monitors a person in Vanuatu, and excludes purely personal or household processing.

Section 4 requires personal data to be processed fairly and transparently, for an explicit, specified and legitimate purpose, adequately and proportionately, accurately, for no longer than necessary, and with reasonable and appropriate security measures against unauthorised or unlawful processing and against accidental or unauthorised access, destruction, loss, use, modification or disclosure.

Section 5 lists the lawful purposes for processing, including the data subject's consent, the performance of a contract, a legal obligation, the public interest, and a legitimate interest that does not override the data subject's rights. Section 8 governs consent: it must be demonstrable, presented clearly and separately from other matters, given for each specific purpose, and withdrawable at any time free of charge.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

Section 15 provides that personal data generated or collected in Vanuatu must not be used elsewhere without the Minister's prior authorisation, section 16 requires safeguards before a transfer outside Vanuatu, including that the recipient country or organisation appears on the Minister's list of jurisdictions providing an appropriate level of protection, and section 17 allows a cross-border transfer in the specific situations it lists, including the data subject's informed consent.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

Section 9 requires a data controller to let a data subject obtain, on request, confirmation that their personal data is being processed, a copy of it, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month, with a reasonable administrative fee or a refusal available only where the request is excessive or unreasonable and the controller bears the burden of proving that.

Section 10 allows a data subject to have processing restricted in the circumstances it lists, section 11 requires inaccurate, unlawfully processed or no longer necessary personal data to be corrected or erased, section 12 gives a right to object to processing, section 13 gives a right not to be subject to a decision based solely on automated processing, including profiling, and section 14 provides for representation of the data subject.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

Section 18 lets the Deputy Commissioner require a data controller in writing to provide a document or information that will assist in determining whether there has been a contravention of the Act, and requires the controller to comply within 14 days of receiving the request. Sections 19 to 23 provide for search warrants over premises, data centres and data servers, and their contents, extension and effect.

Section 24 makes a contravention of the Act an offence punishable on conviction by a fine of up to VT10,000,000, and sections 25 to 30 create further offences, including unlawfully obtaining or disclosing personal data, altering personal data to prevent its disclosure to a data subject, destroying, concealing or falsifying information the Deputy Commissioner has requested, and hindering or obstructing the lawful exercise of powers, with fines of VT1,000,000 or VT2,000,000 attaching to the lesser offences.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

Section 6 prohibits the processing of special categories of personal data, which section 1 defines to include biometric data resulting from specific technical processing, genetic data, and personal data relating to racial or ethnic origin, political opinions, trade-union membership, religious or philosophical belief, health and sexual life, unless one of the exceptions in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.

Section 7 requires the consent of a parent, carer or legal guardian before a child's or other vulnerable individual's personal data is processed, communication with the child in clear and plain language, and appropriate mechanisms for age verification, except where the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.

The Act was assented to on 5 December 2024 and commenced on 2 January 2025, section 32 fixing commencement on the day of publication in the Gazette.

Section 3 makes it an offence to intentionally and without lawful excuse access the whole or part of a computer system by infringing a security measure, punishable by a fine of up to VT2,000,000 or up to 5 years' imprisonment for an individual, or a fine of up to VT4,000,000 for a body corporate; a person is not liable if entitled to access the program or data or has consent to it. Section 4 similarly bars intercepting a non-public transmission of computer data without lawful excuse.

Section 5 makes unauthorised interference with a computer system, program or data an offence carrying a fine of up to VT7,000,000 or up to 40 years' imprisonment for an individual (up to VT100,000,000 for a body corporate), rising to a fine of up to VT50,000,000 or up to 50 years' imprisonment where the interference causes serious harm such as a financial loss over VT1,000,000, a threat to national security, physical injury or death, or a threat to public health or safety, and a lesser fine of up to VT10,000,000 or up to 40 years' imprisonment for reckless interference.

Section 6 makes it an offence, carrying a fine of up to VT1,000,000 or up to 3 years' imprisonment for an individual (up to VT3,000,000 for a body corporate), to produce, sell, procure, import, export, distribute or make available software, a device, or an access code for the purpose of unauthorised interception or interference, unless the act is for authorised training, testing or protection of a computer system.

Section 63, in the Act's mutual-assistance part, confirms that a police officer may access publicly available stored computer data without authorisation regardless of where it is geographically located, consistent with section 3's security-measure-based test for what counts as unauthorised access.

Section 26 provides that an intermediary, defined as a person who on behalf of another sends, receives, stores, or provides other services with respect to an electronic record, is not subject to civil or criminal liability for information in a record it carries if it was not the originator, has no actual knowledge that the information gives rise to liability, and is not aware of facts or circumstances from which the likelihood of liability ought reasonably to have been known; section 26(2) states the intermediary is under no duty to monitor the information it carries to establish such knowledge.

Section 27 requires an intermediary that acquires actual knowledge that carried information gives rise to civil or criminal liability to remove it as soon as practicable and notify the Minister or the appropriate law enforcement agency, and requires an intermediary that becomes aware of facts suggesting a likelihood of liability to follow an approved code of conduct or notify the Minister, who may then direct removal.