TongaPrivacy Act 2025, automated decisions
Privacy Act 2025, s. 44 (right not to be subject to a decision based solely on automated processing)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfA data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Let a data subject avoid a decision based solely on automated processing.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 44 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects, with three exceptions (contract, authorization by a written law with suitable safeguards, and consent). It requires no log of the decisions, no record of their basis and no audit.
- Kind
- None
- As of
What this law does
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
Section 44 gives a data subject the right not to be subject to a decision based solely on automated processing of personal information, including profiling, that produces legal or similarly significant effects concerning them, except where the decision is necessary for entering into or performing a contract, is authorized by a written law with suitable safeguards, or is authorized by the data subject's consent.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .