The framework
Vanuatu has enacted the Data Protection and Privacy Act No. 13 of 2024, but the regime is not yet fully operative.
That puts Vanuatu in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Data Protection and Privacy Act No. 13 of 2024
Vanuatu passed a Data Protection and Privacy Act in 2024 covering both public and private sectors, reported to be in effect from February 2025. The Digital Safety Authority that houses its commissioner is not yet operating.
Marketing and advertising
A comprehensive framework covering public and private sectors; practical enforcement awaits the Digital Safety Authority. That single sentence decides most channel plans here.
Cross-border transfers
The Act regulates transfers abroad, pending an operational regulator.
Enforcement and penalties
The Act provides for penalties that no operating regulator yet enforces.