Duty LXD-8197
Is a crypto-asset provider, in Tonga
Each law's tag says when it binds: from a date not yet set not yet in force in force in force
Cybersecurity Act 2025, Duty to Report a Cybersecurity Incidentfrom a date not yet set3 lines
Act 14 of 2025, s. 15 · Read the law's page
- It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette.
- Within 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification.
- File that report in the form the Minister CPR prescribes.
Cybersecurity Act 2025, Critical Infrastructure Operator Obligationsfrom a date not yet set4 lines
Act 14 of 2025, ss. 11-14, 16-17 · Read the law's page
- It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette; grounds for designation include infrastructure necessary for electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, or public safety and public health including emergency services.
- Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.
- Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.
- Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.
National Reserve Bank of Tonga Act, credit information systemsin force2 lines
National Reserve Bank of Tonga Act [Cap 16.12], s. 59A (credit information systems) · Read the law's page
- If you hold information collected and maintained in a credit information system that collects and disseminates credit information among financial institutions, use it only to improve the quality of bank credit and in the National Reserve Bank of Tonga's supervision of financial institutions (s. 59A(2)).
- The National Reserve Bank of Tonga may regulate, license, register and supervise such credit information systems (s. 59A(1)).