TongaPrivacy Act 2025, sensitive personal information and children
Privacy Act 2025, ss. 28-29 (sensitive personal information and children)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfA sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive personal information, including biometric data such as a voiceprint or facial image, unless a section 27 basis is met and, in addition, the data subject has given and not withdrawn consent to that specific purpose or another section 28 ground applies.
- Before processing a child's personal information, or that of an individual lacking capacity to consent, obtain the consent of a parent or other appropriate legal guardian and apply appropriate age and consent verification mechanisms, including government approved identification documents.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 28 bars processing of sensitive personal information (which section 3 says includes biometric data) unless a section 27 condition and a further consent or necessity ground are met. Section 29(2) requires the controller, or its processor, to apply appropriate mechanisms, including government approved identification documents, to verify age and consent. That is a check made when consent is taken; the clause does not ask the controller to keep, show or produce a record of it. Section 31(1), the controller's burden of proving consent, sits outside the sections this row cites and is recorded on the comprehensive row.
- Kind
- None
- As of
What this law does
Section 28 bars a data controller from processing sensitive personal information, or permitting a data processor to process it on its behalf, unless a section 27 condition has first been met and, in addition, the data subject has given and not withdrawn consent to the specific purpose, or the processing is necessary on one of the grounds the section lists, such as protecting the vital interests of a data subject who cannot consent.
Section 3 defines sensitive personal information to include biometric data.
Section 29 requires the consent of a parent or other appropriate legal guardian before processing the personal information of a child or an individual lacking legal capacity to consent, and requires appropriate mechanisms, including presentation of government approved identification documents, to verify age and consent, except where the processing is necessary to protect that person's vital interests or falls within the other exception the section states.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .