Section 15 of the Data Protection and Privacy Act No. 13 of 2024 prohibits the transfer of personal data generated or collected in Vanuatu to another country without prior authorisation from the Minister, unless the destination is listed by Ministerial Order, on the recommendation of the Deputy Commissioner, as providing an appropriate level of data protection. Section 16 allows the Minister to prescribe additional safeguard procedures for transfers to approved countries or organisations when the data is considered urgent and sensitive. Section 17 permits transfers to non-approved destinations only under specific conditions: if the data subject gives explicit, informed, and freely given consent; if the transfer is necessary to serve the specific interests of the data subject; or if it is required for a purpose approved by the Commission.

Vanuatu has not joined any agreement with binding commitments to open transfers of data across borders.

The Data Protection and Privacy Act No. 13 of 2024 establishes a comprehensive legal framework for the protection of personal data in Vanuatu. Applicable to both public and private sector entities, the Act possesses extraterritorial reach and stipulates conditions for cross-border data transfers. It delineates the rights of data subjects and prescribes detailed provisions governing the processing of personal data, including sensitive categories.

Under Part IV of the E-Business Act, companies engaging in electronic business must appoint a data protection officer.

Section 21 of the Cybercrime Act authorises the Commissioner of Police, by written notice, to require a service provider to disclose subscriber data where the Commissioner is satisfied that such disclosure is necessary for law enforcement purposes or for the enforcement of a serious foreign offence, and obliges the service provider to comply with the request as soon as practicable after it is received; however, the provision does not clarify whether a warrant or court order is required. The Act defines a service provider as any public or private entity that enables users to communicate by means of a computer system, as well as any entity that processes or stores computer data on behalf of such an entity or its users, including service providers regulated under the Telecommunications, Radiocommunications and Broadcasting Regulation Act No. 30 of 2009. Subscriber data is defined as any data held by a service provider, in electronic or other form, relating to a person who uses or rents its services, by which the type of service used, the relevant technical arrangements, and the period of service may be established, together with the subscriber’s identity and contact details, including postal or geographic address, telephone and other access numbers, billing and payment information, and information concerning the location of equipment required to use the service, insofar as such information is available under the service agreement or arrangement; the definition expressly excludes traffic and content data.

The Electronic Transactions Act establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 26 of the Act, an intermediary is not subject to any civil or criminal liability in respect of any information contained in an electronic record in respect of which the intermediary provides services if the intermediary was not the originator of that electronic record and the intermediary: (a) has no actual knowledge that the information gives rise to civil or criminal liability, or (b) is not aware of any facts or circumstances from which the likelihood of civil or criminal liability in respect of the information ought reasonably to have been known; or (c) follows the procedure set out in section 27 if the intermediary: (i) acquires knowledge that the information gives rise to civil or criminal liability; or (ii) becomes aware of facts or circumstances from which the likelihood of civil or criminal liability in respect of the information ought reasonably to have been known.

The Electronic Transactions Act establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 26 of the Act, an intermediary is not subject to any civil or criminal liability in respect of any information contained in an electronic record in respect of which the intermediary provides services if the intermediary was not the originator of that electronic record and the intermediary: (a) has no actual knowledge that the information gives rise to civil or criminal liability, or (b) is not aware of any facts or circumstances from which the likelihood of civil or criminal liability in respect of the information ought reasonably to have been known; or (c) follows the procedure set out in section 27 if the intermediary: (i) acquires knowledge that the information gives rise to civil or criminal liability; or (ii) becomes aware of facts or circumstances from which the likelihood of civil or criminal liability in respect of the information ought reasonably to have been known.

Clause 10 of the SIM Card Registration Regulation Order No. 105 stipulates that individuals intending to purchase a SIM card are required to present a valid identification card or document to the licensed provider.

Vanuatu has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Vanuatu has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

The Trade Secrets Act provides a framework for the effective protection of trade secrets. According to the Act, a trade secret is information that is not commonly known or easily accessible to those involved in similar fields. It can also pertain to someone's business or professional matters and, if disclosed, would negatively impact their lawful activities. Additionally, a trade secret holds commercial value due to its confidentiality and exclusivity. If a trade secret is acquired, used, or disclosed by a person without the authority of the owner of the trade secret, the owner has the right to apply to the Court for a declaration that the trade secret has been acquired, used, or disclosed without authority. The Court may grant an injunction preventing anyone from dealing with, or otherwise using, the secret in a commercial way; and if it is satisfied that the owner has suffered damage because of the unauthorised disclosure—award damages to the owner.

It is reported that passive infrastructure sharing is not mandated, but it is practised in the market in both the mobile and fixed sectors (based on commercial agreements).

In a joint market announcement in September 2025, the Vanuatu National Provident Fund (VNPF) announced that it acquired a 14% shareholding in Telecom Vanuatu Limited (trading as Vodafone Vanuatu).

It is reported that Vanuatu does not mandate accounting separation for operators with significant market power (SMP) in the telecom market. However, it is reported that functional separation has been an obligation since 2022.

Vanuatu has appended the World Trade organization (WTO) Telecom Reference Paper to its schedule of commitments.