TongaPrivacy Act 2025, personal information breaches
Privacy Act 2025, s. 37 (personal information breaches)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfA breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Kept
What it requires
- Notify the Privacy Commission within 72 hours of becoming aware of a personal information breach that is likely to result in a risk to the rights and freedoms of individuals, describing its nature and, where possible, the categories and approximate numbers of data subjects and records concerned.
- As a data processor, notify the data controller or the data processor that engaged you within 72 hours of becoming aware of a personal information breach, and answer their information requests without undue delay.
- Communicate a breach likely to result in a high risk to a data subject to that person without undue delay, in plain and clear language, with advice on how to mitigate the effects, or through widely used media where direct communication would take disproportionate effort or expense.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 37(8) makes the controller and the processor keep a record of every personal information breach, with the facts, its effects and the remedial action taken, in a manner that enables the Commission to verify compliance. The record covers every breach, whether or not it is notified. The facts, effects and remedial action are not log content values, so the contents are left empty. Section 37 sets no period for keeping the record. The notices to the Commission, to the engaging controller and to data subjects in section 37(1) to (3) are reports and not records. Under section 37(11) the section does not apply until the second anniversary of the commencement date.
- Kind
- Explicit
- As of
- Provision
- Section 37(8) (the data controller and data processor keep a record of all personal information breaches)
- Trigger
- security_incident
What this law does
Section 37(1) requires a data processor that becomes aware of a personal information breach to notify the data controller or the data processor that engaged it within seventy-two hours, describing the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, and to respond without undue delay to information requests from whoever engaged it.
Section 37(2) requires a data controller to notify the Commission within seventy-two hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals, with the same description.
Section 37(3) requires the controller to communicate a breach likely to result in a high risk to a data subject to that data subject without undue delay, in plain and clear language, with advice on measures they could take to mitigate the adverse effects, and allows a public communication through widely used media where direct communication would involve disproportionate effort or expense.
Section 37(11) provides that section 37 does not apply until the second anniversary of the commencement date. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .