TongaPrivacy Act 2025, notification to data subjects and rights of data subjects
Privacy Act 2025, ss. 33, 42-43, 45-47 (notification and rights)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfA data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Data subject rights
- Audit expectation
- none
What it requires
- At the time you collect personal information, tell the data subject your identity and contact details, that you are collecting it, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and who the intended recipients are.NIST Privacy FrameworkCM.AW-P1
- On request, confirm whether you process a data subject's personal information and where it came from, give them a copy in a commonly used electronic format, and correct or delete information that is inaccurate, out of date, incomplete or misleading, without constraint or unreasonable delay and at no expense.NIST Privacy FrameworkCT.PO-P3
- Act on a written request to stop processing personal information for direct marketing as soon as reasonably practicable, and in any event within 30 days of receiving it.NIST Privacy FrameworkCT.PO-P3
- Let a data subject object to processing and withdraw consent.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 33 requires the controller to tell a data subject, at collection, what is collected and why; section 42 gives rights to confirmation, a copy, correction and deletion; section 43 lets a data subject stop direct marketing by written notice and requires the controller to notify them in writing of the action taken within 30 days; sections 45 and 46 cover objection and withdrawal of consent; section 47 lets the Minister set a portability right by regulation. These are notices and data-subject rights. Section 45(2) lets a controller keep processing after an objection only if it demonstrates overriding grounds, which is a condition for continuing and not a record duty. No section in the row requires a log or record or names an audit.
- Kind
- None
- As of
What this law does
Section 33 requires a data controller collecting personal information directly from a data subject to tell them, at the time of collection, the controller's identity and contact details, that personal information is being collected, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and the intended recipients.
Section 42 gives a data subject the right to obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their personal information is being processed and its source, a copy in a commonly used electronic format, and correction or deletion of information that is inaccurate, out of date, incomplete or misleading or that the controller is not entitled to retain.
Section 43 lets a data subject stop direct marketing by written notice, which the controller must act on as soon as reasonably practicable and in any event within 30 days. Sections 45 and 46 give the rights to object to processing and to withdraw consent, and section 47 empowers the Minister to make regulations under section 68 to establish a right to portability of personal information. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .