VPNs with servers in Haiti

The data-protection arrêté published in Le Moniteur no. 87 of 15 May 2018 forbids any release of personal data likely to infringe an individual’s rights and requires stored data to be kept confidential, with access limited to those who need it. A commercial legal survey records that no data-protection authority exists yet.

A revised Penal Code adopted by decree in 2020 contains offences concerning automated data systems (arts. 587–593) and breach of correspondence secrecy, including interception of telecommunications (art. 436). Its entry into force was postponed from June 2024 to June 2025, and on 24 December 2025 a further postponement was announced, with no new date. Whether a VPN operator falls under any of these provisions is not established.

The constitution provides that every Haitian may express opinions freely on any matter by any means (art. 28), that journalists’ work may not be subject to authorisation or censorship except in war (art. 28-1), and that offences involving the press and abuses of the right of expression come under the criminal code (art. 28-3).

According to a commercial legal survey, the revised Penal Code’s art. 436 would punish breach of correspondence secrecy, including interception of telecommunications, with six months to one year in prison, a fine, or both, and its art. 437 processing of personal data in breach of legal formalities with one to three years, a fine, or both; neither is yet in force.

The constitution requires a well-founded judicial ruling before communications privacy may be limited (art. 49). The 2018 data-protection arrêté, on a commercial survey’s account, has no supervisory authority to enforce it, and the revised Penal Code’s computer-offence and interception provisions await entry into force. The order of the rows is the security score, and a server’s location is not a recommendation.