What Is Data Protection and Privacy Act No. 13 of 2024?
Vanuatu's Data Protection and Privacy Act No. 13 of 2024 was assented on 5 December 2024 and commenced on 2 January 2025. It applies to processing of personal data in the private and public sectors, processing within Vanuatu, data generated or collected in Vanuatu regardless of where processing occurs, and certain processing by a controller/processor outside Vanuatu concerning individuals in Vanuatu. Section 9 provides a written, plain-language, free access right within one month (subject to a reasonable fee or refusal for excessively unreasonable requests). Section 11 requires rectification of inaccurate/incomplete data without delay and free of charge, and provides erasure without delay and free of charge in listed circumstances (no longer necessary, withdrawn consent, an unoverridden objection, unlawful processing, or a legal obligation to erase), with third-party notification unless impossible or disproportionate. Sections 10 and 12 provide objection (free, at any time, absent overriding legitimate grounds or a legal claim) and restriction in listed situations. This is a source-backed evidence profile. No separate direct-marketing opt-out clause was located; do not treat the general objection right as a direct-marketing-specific right without further source review. No Vanuatu-specific data-broker registry or public-record removal mechanism was located.
At a glance
- Full name
- Data Protection and Privacy Act No. 13 of 2024
- Short code
- Vanuatu DPPA 2024
- Jurisdiction
- Vanuatu
- Enacted
- 2024
- Last major update
- Assented 5 December 2024; commenced 2 January 2025
- Regulator
- Deputy Commissioner of Data Protection and Privacy (appointed under the Digital Safety Authority Act No. 15 of 2024)
- Private right of action
- Limited
- Statutory citation
- Data Protection and Privacy Act No. 13 of 2024
Scope, who Vanuatu DPPA 2024 covers
Protected data
Data subject rights
Access: confirmation of processing, a copy of the data, and information on purposes, source, recipients, transfers, and retention, in writing/plain language/free of charge, within one month (section 9)
Correction of inaccurate or incomplete data, without delay and free of charge (section 11)
Erasure without delay and free of charge in listed circumstances, with third-party notification unless impossible or disproportionate (section 11)
Objection at any time, free of charge, absent overriding legitimate grounds or a legal claim (section 10)
Restriction of processing in listed situations, including contested accuracy or unlawful processing (section 12)
Protection from a decision significantly affecting the subject based solely on automated processing, subject to statutory safeguards (section 13)
Notable features
The Deputy Commissioner role is created under the companion Digital Safety Authority Act No. 15 of 2024 rather than a standalone data-protection commission statute. No dedicated public data-protection complaint form or named intake inbox was located in this pass.
Enforcement & penalties
Penalties: The reviewed official Act text for this research pass focused on rights and the complaint/investigation structure rather than a consolidated fine schedule; a penalty figure was not confirmed in this pass.
Private right of action: Section 14 lets a data subject authorize a person, non-profit body, organization, or association to lodge and pursue a complaint on their behalf with the Deputy Commissioner or the Court; the Digital Safety Authority Act separately requires a decision on a complaint about the Deputy Commissioner’s own service within 21 working days.
Relevance to data brokers
No Vanuatu-specific data-broker registry, private broker opt-out route, or public-record removal mechanism was located. Vanuatu’s Right to Information Unit provides a route to request one’s own information held by a government public authority, which is a government-records access route, not a private-broker removal route.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
When did Vanuatu’s data-protection law take effect?+
The Data Protection and Privacy Act No. 13 of 2024 was assented on 5 December 2024 and commenced on 2 January 2025.
Does Vanuatu’s Act include a direct-marketing opt-out?+
No separate direct-marketing clause was located in the published Act during this research pass; the general objection right should not be assumed to cover marketing specifically without further source review.
Official sources & citations
Other international privacy regimes
Vanuatu DPPA 2024 sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: