VU

Vanuatu's comprehensive data-protection statute is the Data Protection and Privacy Act No. 13 of 2024. <cite index="1-4,1-5">Law: Data Protection and Privacy Act No. 13 of 2024 (the Data Protection and Privacy Act) Regulator: Deputy Commissioner of Data Protection and Privacy. The Data Protection and Privacy Act came into effect on January 2, 2025, and applies to both the public and private sector.</cite> <cite index="1-6">The Data Protection and Privacy Act has an extraterritorial application, provides requirements for cross-border transfers, data subject rights, and rules relating to processing of personal data, including special category data.</cite> No official gazette text, enabling regulations, or the statutory provision establishing the Deputy Commissioner's office could be retrieved via available search channels (vanuatu.gov.vu, PacLII, and the national gazette were searched but did not surface a reachable primary-instrument URL within the retrieval allowlist). Registration/filing obligations, the precise territorial-scope test (targeting/monitoring limbs), and any representative-appointment duty analogous to GDPR Art 27 are therefore not independently verified against primary text.

Secondary commentary confirms the Act <cite index="1-6">provides ... rules relating to processing of personal data, including special category data</cite>, but the enumerated lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests), the conditions-of-consent test, and the special-category processing conditions have not been located in primary text despite targeted search for the Act's text and implementing regulations.

Secondary commentary states the Act <cite index="1-6">provides requirements for ... data subject rights</cite> generally, but statutory response deadlines, extension tests, erasure grounds/exceptions, and the age at which minors may exercise rights independently were not located in primary text.

No findings. Searches run: 'Vanuatu Data Protection and Privacy Act DPO requirements', 'Vanuatu data protection breach notification', 'Vanuatu DPIA ROPA' and the primary Act/gazette text — none surfaced reachable primary-source detail on DPIA triggers, DPO appointment thresholds, ROPA exemption tests, processor-contract mandatory terms, breach-notification thresholds/timelines, or retention/disposal duties. This is recorded as an explicit gap, not an inference of absence of regulation.

The Act is reported to <cite index="1-6">provide requirements for cross-border transfers</cite>, but the specific transfer-mechanism menu (adequacy-style finding, contractual clauses, consent derogation) and any data-localisation provision were not located in primary text. Separately, current EU Commission/BfDI adequacy listings confirm Vanuatu has not received an EU adequacy decision: <cite index="75-5">Adequacy decisions currently exist for Argentina, Brazil, Canada (only in relation to the private sector), Israel, Japan (only in relation to the private sector), New Zealand, Republic of Korea, Switzerland, the United Kingdom (UK), Uruguay, the USA (only in relation to US companies and organisations participating in the EU-US Data Privacy Framework (EU-US DPF)) as well as the European Patent Organisation.</cite> No evidence was found that Vanuatu has granted any outbound adequacy-equivalent recognition to other jurisdictions.

No sector-specific overlay findings (financial, health, telecoms, employment, credit, education, insurance, or horizontal data-access/sharing schemes) could be sourced for Vanuatu. Searches run: 'Vanuatu financial sector data protection banking secrecy', 'Vanuatu telecoms data retention', 'Vanuatu employment data protection code' — none returned Vanuatu-specific sectoral instruments distinct from the general Data Protection and Privacy Act. Given Vanuatu's status as an offshore financial centre, a financial-sector overlay is plausible but unconfirmed; this is recorded as a gap, not a finding.

No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent rule specific to Vanuatu could be sourced. Searches run: 'Vanuatu cookie law', 'Vanuatu direct marketing consent', 'Vanuatu ePrivacy' — no results returned Vanuatu-specific adtech provisions.

No Vanuatu-specific automated-decision-making, AI-risk-assessment, biometric, genetic-data, or state-surveillance-carveout provisions were located. The general Act may contain a profiling/ADM analogue, but no pinpoint provision was sourced. Searches run: 'Vanuatu automated decision making law', 'Vanuatu facial recognition biometric law', 'Vanuatu AI regulation'.

No Vanuatu-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adult protection was located in available sources. Searches run: 'Vanuatu age of consent data protection children', 'Vanuatu minors data privacy law'.

A regulator (Deputy Commissioner of Data Protection and Privacy) exists under the Act, implying some enforcement function, but maximum-fine tiers, investigation/decision deadlines, appeal routes, collective-redress or private-right-of-action mechanisms, and any enforcement activity in the last 12 months could not be located in reachable sources. No Vanuatu-specific enforcement decisions or penalty figures are reported in any retrievable source as of this research pass; a figure found during research ('P500,000'/Pula-denominated penalty text) was identified as belonging to an unrelated Botswana bill and was explicitly excluded to avoid jurisdiction misattribution.