TongaCybersecurity Act 2025, Duty to Report a Cybersecurity Incident
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0037/CybersecurityAct2025_1.pdfA vulnerability and incident reporting rule binding public and private bodies.
What it requires
- It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette.
- Within 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification.
- File that report in the form the Minister CPR prescribes.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Section 19(3) sets two separate fixed ceilings by class of contravener: not exceeding $500,000 for an individual and not exceeding $1,000,000 for a body corporate. The Act does not define the currency the bare "$" denotes; Tonga's legal tender is the Pa'anga (ISO 4217: TOP), confirmed on the National Reserve Bank of Tonga's own site (reservebank.to); that currency is recorded here in the absence of an express definition in the Act itself. The amount is a court-ordered civil pecuniary penalty recovered through a civil action the Attorney General institutes under section 18, not a fixed administrative fine or a criminal sentence, and section 19 applies to a contravention of any provision of Division 2 of Part V, section 15's reporting duty included.
- Rule
- Fixed only
- As of
- Currency
- TOP
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Attorney General, who may institute civil proceedings in a court of competent jurisdiction against an operator of critical infrastructure for a pecuniary penalty for contravening the reporting duty; the Computer Emergency Response Team and the Minister responsible for cybersecurity policy and regulation (Minister CPR) receive and act on reports under Part IV.
Settledness
- As of
- Open questions
- Has Cabinet proclaimed a commencement date for the Cybersecurity Act 2025 under section 1(2), and if so what is it?
- Which infrastructure assets, systems or networks, if any, has the Minister responsible for cybersecurity policy and regulation designated as critical infrastructure under section 11, since the reporting duty binds only an operator so designated?
- Does the pecuniary-penalty cap in section 19(3), stated only as "$500,000" and "$1,000,000", denote the Tongan Pa'anga or another currency?
What it reaches
Obligation class
Reporting, Security
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- The Minister responsible for cybersecurity policy and regulation has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 of the Cybersecurity Act 2025, and published that designation in the Government Gazette.
What this law does
Section 15 requires an operator of critical infrastructure designated under section 11 to report a cybersecurity incident to the Computer Emergency Response Team (CERT) within 24 hours of becoming aware of it, whether the incident affects the information systems of the designated infrastructure itself, any information system interconnected with or communicating with those systems, or any other incident the Minister responsible for cybersecurity policy and regulation has designated as requiring notification, in a form that Minister prescribes.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.
Back to the example · Lint your app
Page updated .