TongaPrivacy Act 2025, comprehensive personal information protection regime
Privacy Act 2025 (Act 34 of 2025), ss. 1-6, 27, 30-32, 34-36 and 38
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A comprehensive regime rule binding public and private bodies.
As of 19 September 2026.
What it requires
- This law is recorded as enacted, but the Cabinet proclamation that would fix its commencement date under section 1(2) has not been located, so whether it is yet in force has to be established before relying on what follows.
- Do not process personal information unless the data subject has given specific, informed consent that has not been withdrawn, or another lawful basis in section 27 applies, such as contractual necessity, a legal obligation, vital interests or the public interest.
- Process personal information only for a lawful purpose related to your function or activity, take all reasonable steps to keep it accurate, complete, not misleading and up to date for that purpose, and hold no more than is adequate, relevant and limited to it.
- Do not retain personal information longer than the purpose requires, and once retention is no longer necessary, return, destroy, render inaccessible or permanently de-identify it within a reasonable time.
- Implement appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction of or damage to personal information, and unlawful or unauthorised access to or processing of it.
Who enforces it
Settledness
- As of
- 6 September 2026
- Open questions
- Has Cabinet proclaimed a commencement date for the Act under section 1(2), and if so, on what date does the Act take effect?
- Does the "generally available publication" exemption in section 48(1)(a) reach personal information an organisation posts on an ordinary public website, or only material with the media-style character the term's own definition lists (a magazine, book, article, newspaper)?
What it reaches
Obligation class
Consent, Security, Retention
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 27 bars a data controller from processing personal information, or permitting a data processor to do so on its behalf, except on a lawful basis it lists, beginning with the data subject's consent to the specific purpose and running through contractual necessity, a legal obligation, vital interests and the public interest.
Section 31 governs reliance on consent and section 32 requires processing to be for a lawful purpose related to the controller's function or activity, personal information to be accurate, complete, not misleading and up to date to the extent the purpose requires, and the information held to be adequate, relevant and limited to that purpose.
Section 34 bars retention for longer than the purpose requires and requires the information to be returned, destroyed, rendered inaccessible or permanently de-identified within a reasonable time once retention is no longer necessary.
Section 35 governs the engagement of a data processor, section 36 requires appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction, damage or access, and section 38 lets the Minister make regulations requiring a personal information protection impact assessment for high-risk processing.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established. Separately, press reporting (Tonga Independent News, 6 January 2026) states the Act was gazetted into force alongside a package of other 2025 governance-reform statutes, and no Cabinet proclamation confirming that has been located.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.