TongaPrivacy Act 2025, transfers of personal information outside the Kingdom
Privacy Act 2025, ss. 39-41 (transfers outside the Kingdom)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfA cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal information outside Tonga unless the Privacy Commission has consented in writing, or the recipient is bound by a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection.NIST Privacy FrameworkCT.PO-P2
- Where you rely on the data subject's consent to transfer without adequate protection, inform them of the risks first and stop if they withdraw it.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 39 bars transfer of personal information outside the Kingdom unless the Commission consents or the recipient is bound by a mechanism affording adequate protection, subject to the exceptions in section 39(2), including the data subject's informed consent. Section 40 says how adequacy is judged. Section 41 requires each controller and processor to develop, maintain and implement the policies and practices it needs to comply, to run a complaints process, to tell its staff of them and to give any member of the public information about them on request. Those are duties to hold and share policies and not to keep a record of processing or of transfers, so no record duty is recorded and the section names no audit.
- Kind
- None
- As of
What this law does
Section 39(1) bars a data controller or data processor from transferring personal information to a country or territory outside the Kingdom unless the Commission has given written consent to the transfer or the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection under section 40.
Section 39(2) disapplies that bar where the data subject has given and not withdrawn consent after being informed of the risks of transferring without adequate protection, or another listed situation applies. Section 40 sets out how adequacy is determined, and section 40(3) to (6) provides for the Commission's related designations, approvals and determinations. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .