TongaPrivacy Act 2025, penalties, enforcement and third party actions
Privacy Act 2025, ss. 52-66 (penalties, enforcement and investigation)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfAn enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with an enforcement notice the Privacy Commission serves on you, and with an information notice in an investigation.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 54(4) sets four separate caps rather than one: an individual's first contravention is capped at TOP 5,000, an individual's subsequent contravention at the greater of TOP 30,000 or three times the value of the benefit obtained from the contravention, an organisation's or public authority's first contravention at TOP 30,000, and a subsequent contravention by an organisation or public authority at TOP 100,000. The highest fixed ceiling the section states is TOP 100,000; an individual's subsequent contravention is instead capped at the greater of TOP 30,000 or three times the benefit, which no fixed figure states. The court fixes the actual amount within the applicable cap having regard to the nature and extent of the contravention and any prior findings against the same data controller or data processor. The Act states these figures in dollars, understood here as Tongan pa'anga.
- Rule
- Fixed only
- As of
- Currency
- TOP
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Privacy Commission
Settledness
- As of
- Open questions
- Has Cabinet proclaimed the date on which the Privacy Act 2025 comes into force under section 1(2), which provides that the Act "shall come into force on a date proclaimed by Cabinet"?
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 52 to 57 provide for contraventions, pecuniary penalties, enforcement notices, enforceable undertakings and third-party actions, and sections 58 to 66 for information notices, investigations, search powers, confidentiality and review. None requires a controller or processor to make, keep or produce a log or record in the ordinary course. The Commission's powers are powers to check what a controller holds: an information notice may demand information and documentation about the processing of personal information and about the policies and documentation kept under section 41 (section 58(1)(a) and (c)), and an officer with a Magistrate's warrant may inspect any book, record, document, database or electronic file kept at the premises (section 61(1)(c)). The record duties sit in other sections: section 37(8) for breaches and section 31(1) for consent.
- Kind
- None
- As of
What this law does
Section 52 deems every omission or failure to comply with the Act, and every act contrary to it, a contravention. Section 54 lets a court order a pecuniary penalty for a contravention, capped by section 54(4) at TOP 5,000 for an individual's first contravention and, for a subsequent one, the greater of TOP 30,000 or three times the benefit obtained, and at TOP 30,000 for an organisation's or public authority's first contravention rising to TOP 100,000 for a subsequent one.
Section 55 lets the Commission serve an enforcement notice specifying the provisions it considers contravened and the reasons, section 56 provides for enforceable undertakings, and section 57 lets a data subject who has sustained loss or damage recover it by action, with the Commission able to bring the proceeding as representative of a class or to intervene. Sections 58 to 66 provide for information notices, investigation of complaints and the Commission's related powers.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .