Processes personal data, in Tonga

Mental Health Act [Cap 12.10] (Act 8 of 2001), ss. 92(4) and 93 (confidentiality of mental health patient records) · Read the law's page

• If you keep records for a mental health facility or a health care agency, do not disclose, directly or indirectly, information that identifies a person as a patient of, or as having received treatment from, the facility or agency and that relates to the nature or other details of admission or treatment, except to fulfil a requirement under the Act or other legislation (s. 92(4)).
• You may disclose such information with the person's prior consent (or the next of kin's consent if the person has died), as a court requires in criminal proceedings, for continuing care of a closely involved relative where disclosure is necessary to protect the person, for medical or social research the Minister is satisfied is necessary and not detrimental to the person, or where the Minister considers it in the public interest (s. 93).

Act 31 of 2025, s. 54 (Personal Health Information Protection Act 2025, disclosure outside Tonga) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Disclose personal health information collected in Tonga to a person outside Tonga only with the person's consent, where the Act permits the disclosure, where the recipient performs functions comparable to those of a person to whom the Act permits disclosure in Tonga, or where the disclosure is reasonably necessary for the person's health care (unless they have expressly instructed you not to) or for payments in connection with it (s. 54(1)).
• Where the person's instruction stops you disclosing all the information reasonably necessary for their care, tell the recipient so (s. 54(2)).

Act 31 of 2025, ss. 10, 14(1), 31-32, 40 and 55 (Personal Health Information Protection Act 2025) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Collect, use or disclose personal health information only with the person's consent where it is necessary for a lawful purpose, or where the Act permits or requires it, and never where other information will serve or beyond what is reasonably necessary (ss. 31-32).
• Take reasonable steps to protect personal health information against theft, loss and unauthorized access, use or disclosure (s. 14(1)).
• If you use electronic means to handle personal health information, keep an electronic audit log of each time a record is viewed, handled or modified, and audit and monitor it as often as the Regulations prescribe (s. 10).
• Keep genetic test information in a separate record from the rest of the person's personal health information (s. 40).
• Before disclosing sensitive personal health information, such as genetic test information, HIV or AIDS, a sexually transmitted disease, a mental disorder, a pregnancy, sexual assault or abuse, or anything the person has marked sensitive, tell the person, the recipient and the reason, consider the person's views and note the record, and disclose none if other information will serve and no more than is necessary (s. 55).

Act 31 of 2025, ss. 14(2)-(3), 19(5)(b) and 70(6) (Personal Health Information Protection Act 2025) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• If personal health information about a person is stolen or lost, or is used or disclosed without authority, notify the person at the first reasonable opportunity and say in the notice that they may complain to the Chief Executive Officer responsible for health (s. 14(2)).
• Notify the Chief Executive Officer responsible for health of the theft, loss or unauthorized access, use or disclosure where the circumstances meet the requirements the Regulations prescribe (s. 14(3)).
• If you are an agent of a custodian, notify the custodian at the first reasonable opportunity when personal health information you handled for it is stolen or lost, or is used or disclosed without authority (s. 19(5)(b)).
• If you are responsible for collecting personal health information without authority by means of the National Health Information System, notify the person at the first reasonable opportunity (s. 70(6)).

Act 31 of 2025, ss. 57-60 (Personal Health Information Protection Act 2025, access and correction) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Give a person who asks in writing access to the record of personal health information about them that you hold, subject to the exceptions in section 57(1), in an electronic format that meets the Regulations where they ask for one (ss. 57-58).
• Respond to a request for access no later than 30 days after receiving it, or within the time the person specifies if they show an urgent need and you can reasonably meet it, and extend the limit only by up to 30 days, on written notice (s. 59(3)-(6)).
• If you refuse access in whole or in part, give the person a written notice with the reason and say that they may complain to the Chief Executive Officer responsible for health (s. 59(1)(c)).
• On a written request, correct a record of personal health information that the person shows you is incomplete or inaccurate, and reply by written notice no later than 30 days after receiving the request (s. 60(1), (2), (7)).
• If you refuse a correction, give reasons and tell the person they may attach a statement of disagreement to their records and complain to the Chief Executive Officer (s. 60(10)).

Act 31 of 2025, ss. 76-81, 87 and 89 (Personal Health Information Protection Act 2025, enforcement) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Comply with a direction the Chief Executive Officer responsible for health gives after reviewing a complaint, and produce the records and documents the Chief Executive Officer or an authorised officer demands in a review (ss. 78(2), 79(1)).
• Do not obstruct the Chief Executive Officer or an authorised officer, or give them false or misleading information (s. 78(3)).
• Do not dismiss or otherwise disadvantage a person for reporting a contravention of the Act to the Chief Executive Officer (s. 87).

Privacy Act 2025 (Act 34 of 2025), ss. 1-6, 27, 30-32, 34-36 and 38 · Read the law's page

• Do not process personal information unless the data subject has given specific, informed consent that has not been withdrawn, or another lawful basis in section 27 applies, such as contractual necessity, a legal obligation, vital interests or the public interest.
• Process personal information only for a lawful purpose related to your function or activity, take all reasonable steps to keep it accurate, complete, not misleading and up to date for that purpose, and hold no more than is adequate, relevant and limited to it.
• Do not retain personal information longer than the purpose requires, and once retention is no longer necessary, return, destroy, render inaccessible or permanently de-identify it within a reasonable time.
• Implement appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction of or damage to personal information, and unlawful or unauthorised access to or processing of it.

Privacy Act 2025, s. 37 (personal information breaches) · Read the law's page

• Notify the Privacy Commission within 72 hours of becoming aware of a personal information breach that is likely to result in a risk to the rights and freedoms of individuals, describing its nature and, where possible, the categories and approximate numbers of data subjects and records concerned.
• As a data processor, notify the data controller or the data processor that engaged you within 72 hours of becoming aware of a personal information breach, and answer their information requests without undue delay.
• Communicate a breach likely to result in a high risk to a data subject to that person without undue delay, in plain and clear language, with advice on how to mitigate the effects, or through widely used media where direct communication would take disproportionate effort or expense.

Privacy Act 2025, ss. 28-29 (sensitive personal information and children) · Read the law's page

• Do not process sensitive personal information, including biometric data such as a voiceprint or facial image, unless a section 27 basis is met and, in addition, the data subject has given and not withdrawn consent to that specific purpose or another section 28 ground applies.
• Before processing a child's personal information, or that of an individual lacking capacity to consent, obtain the consent of a parent or other appropriate legal guardian and apply appropriate age and consent verification mechanisms, including government approved identification documents.

Privacy Act 2025, ss. 33, 42-43, 45-47 (notification and rights) · Read the law's page

• At the time you collect personal information, tell the data subject your identity and contact details, that you are collecting it, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and who the intended recipients are.
• On request, confirm whether you process a data subject's personal information and where it came from, give them a copy in a commonly used electronic format, and correct or delete information that is inaccurate, out of date, incomplete or misleading, without constraint or unreasonable delay and at no expense.
• Act on a written request to stop processing personal information for direct marketing as soon as reasonably practicable, and in any event within 30 days of receiving it.
• Let a data subject object to processing and withdraw consent.

Privacy Act 2025, ss. 39-41 (transfers outside the Kingdom) · Read the law's page

• Do not transfer personal information outside Tonga unless the Privacy Commission has consented in writing, or the recipient is bound by a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection.
• Where you rely on the data subject's consent to transfer without adequate protection, inform them of the risks first and stop if they withdraw it.

Privacy Act 2025, ss. 52-66 (penalties, enforcement and investigation) · Read the law's page

• Comply with an enforcement notice the Privacy Commission serves on you, and with an information notice in an investigation.