TongaPrivacy Act 2025, comprehensive personal information protection regime
Privacy Act 2025 (Act 34 of 2025), ss. 1-6, 27, 30-32, 34-36 and 38
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfA comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Security, Retention
- Audit expectation
- none
What it requires
- Do not process personal information unless the data subject has given specific, informed consent that has not been withdrawn, or another lawful basis in section 27 applies, such as contractual necessity, a legal obligation, vital interests or the public interest.NIST Privacy FrameworkCT.PO-P1
- Process personal information only for a lawful purpose related to your function or activity, take all reasonable steps to keep it accurate, complete, not misleading and up to date for that purpose, and hold no more than is adequate, relevant and limited to it.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCT.PO-P2
- Do not retain personal information longer than the purpose requires, and once retention is no longer necessary, return, destroy, render inaccessible or permanently de-identify it within a reasonable time.NIST Privacy FrameworkCT.DM-P5
- Implement appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction of or damage to personal information, and unlawful or unauthorised access to or processing of it.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P5Data are destroyed according to policy.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Has Cabinet proclaimed a commencement date for the Act under section 1(2), and if so, on what date does the Act take effect?
- Does the "generally available publication" exemption in section 48(1)(a) reach personal information an organisation posts on an ordinary public website, or only material with the media-style character the term's own definition lists (a magazine, book, article, newspaper)?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 31(1) puts the burden of proof for establishing a data subject's consent, or a parent's or guardian's consent for a child or a person lacking capacity, on the data controller wherever consent is required or relied on under Part III. A controller can carry that burden only from a record of the consent, so the clause calls for a consent record although it names no log. Section 34 limits how long personal information may be kept; that limits the data and not a record. Section 36(2)(c) requires a controller to verify its own safeguards regularly and section 38 lets the Minister require impact assessments by regulation; neither names a record or a review of one, so no audit is recorded. The breach record of section 37(8) sits outside the sections this row cites. Section 5(1) applies the Act to a controller or processor established in the Kingdom, to processing that relates to the targeted offering of goods or services to a data subject in the Kingdom, and to the monitoring of behaviour that takes place within the Kingdom; section 5(1)(b), processing that occurs within the Kingdom, turns on where the processing takes place and is left out of the hook.
- Kind
- Implicit
- As of
- Provision
- Section 31(1) (the data controller bears the burden of proof for establishing a data subject's consent)
- Trigger
- consent_or_optout
What this law does
Section 27 bars a data controller from processing personal information, or permitting a data processor to do so on its behalf, except on a lawful basis it lists, beginning with the data subject's consent to the specific purpose and running through contractual necessity, a legal obligation, vital interests and the public interest.
Section 31 governs reliance on consent and section 32 requires processing to be for a lawful purpose related to the controller's function or activity, personal information to be accurate, complete, not misleading and up to date to the extent the purpose requires, and the information held to be adequate, relevant and limited to that purpose.
Section 34 bars retention for longer than the purpose requires and requires the information to be returned, destroyed, rendered inaccessible or permanently de-identified within a reasonable time once retention is no longer necessary.
Section 35 governs the engagement of a data processor, section 36 requires appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction, damage or access, and section 38 lets the Minister make regulations requiring a personal information protection impact assessment for high-risk processing. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet.
No notice appointing the day the Act comes into force has been located. Separately, press reporting (Tonga Independent News, ) states the Act was gazetted into force alongside a package of other 2025 governance-reform statutes, and no Cabinet proclamation confirming that has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .