TongaComputer Crimes Act 2025, unauthorised access to or modification of computer data
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
As of .
What it requires
- Do not cause unauthorised access to or modification of computer data, knowing it is unauthorised and intending to cause it; access is unauthorised where the person is not entitled to cause it.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
On conviction of the s. 6 offence, an individual faces a fine of up to TOP 10,000, or imprisonment of up to 3 years, or both, and a corporation faces a fine of up to TOP 50,000. Other offences in the same Act carry higher penalties.
Penalty structure
The s. 6 ceiling is the corporation's fine of TOP 50,000; an individual faces a fine of up to TOP 10,000, or imprisonment of up to 3 years, or both. Amounts are stated in dollars in the Act, understood as Tongan pa'anga.
- Rule
- Fixed only
- As of
- Currency
- TOP
- Fixed cap
- 50,000
What this law does
Section 6(1) makes it an offence for a person to cause unauthorised access to or modification of computer data, knowing the access or modification is unauthorised and intending to cause it. On conviction an individual faces a fine not exceeding $10,000, or imprisonment not exceeding 3 years, or both, and a corporation faces a fine not exceeding $50,000.
Under Section 5(1) access is unauthorised if the person is not entitled to cause it, and under Section 5(2) it is not unauthorised only because the person has an ulterior purpose for causing it. Section 2 defines access to computer data to include the display of the data by a computer system or any other output of the data from the computer system. The Act was passed by the Legislative Assembly on . It carries the King's assent dated .
Under Section 1(2) the Act comes into force on a date proclaimed by Cabinet, and no proclamation of that date has been located. Section 78(1) repeals the earlier Computer Crimes Act.
When LexLint raises it
When your app profile says your app crawls the web or trains models.