Tonga

Section 14(2) requires a custodian whose personal health information about a person is stolen or lost, or is used or disclosed without authority, to notify the person at the first reasonable opportunity and to state in the notice that the person is entitled to complain to the Chief Executive Officer responsible for health.

Section 14(3) requires the custodian to notify the Chief Executive Officer of the theft, loss or unauthorized access, use or disclosure where the circumstances meet the requirements the Regulations prescribe. Section 19(5)(b) requires an agent of a custodian to notify the custodian at the first reasonable opportunity if personal health information the agent handled for it is stolen or lost or is used or disclosed without authority.

Section 70(6) requires a custodian responsible for collecting personal health information about a person without authority by means of the National Health Information System to notify the person at the first reasonable opportunity.

Section 37(1) requires a data processor that becomes aware of a personal information breach to notify the data controller or the data processor that engaged it within seventy-two hours, describing the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, and to respond without undue delay to information requests from whoever engaged it.

Section 37(2) requires a data controller to notify the Commission within seventy-two hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals, with the same description.

Section 37(3) requires the controller to communicate a breach likely to result in a high risk to a data subject to that data subject without undue delay, in plain and clear language, with advice on measures they could take to mitigate the adverse effects, and allows a public communication through widely used media where direct communication would involve disproportionate effort or expense.

Section 37(11) provides that section 37 does not apply until the second anniversary of the commencement date. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Section 27 bars a data controller from processing personal information, or permitting a data processor to do so on its behalf, except on a lawful basis it lists, beginning with the data subject's consent to the specific purpose and running through contractual necessity, a legal obligation, vital interests and the public interest.

Section 31 governs reliance on consent and section 32 requires processing to be for a lawful purpose related to the controller's function or activity, personal information to be accurate, complete, not misleading and up to date to the extent the purpose requires, and the information held to be adequate, relevant and limited to that purpose.

Section 34 bars retention for longer than the purpose requires and requires the information to be returned, destroyed, rendered inaccessible or permanently de-identified within a reasonable time once retention is no longer necessary.

Section 35 governs the engagement of a data processor, section 36 requires appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction, damage or access, and section 38 lets the Minister make regulations requiring a personal information protection impact assessment for high-risk processing. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet.

No notice appointing the day the Act comes into force has been located. Separately, press reporting (Tonga Independent News, 6 January 2026) states the Act was gazetted into force alongside a package of other 2025 governance-reform statutes, and no Cabinet proclamation confirming that has been located.

Section 54(1) allows a custodian to disclose personal health information about a person collected in Tonga to a person outside Tonga only if the person consents, the Act permits the disclosure, the recipient performs functions comparable to those of a person to whom the Act permits disclosure in Tonga, the disclosure is reasonably necessary for the person's health care, or it is reasonably necessary for payments in connection with that care.

A custodian prescribed by the Regulations may also disclose personal health information to the government of the place where a person now resides, for health planning or health administration, if the information relates to health care provided in Tonga to that person. If the person's express instruction stops a custodian disclosing all the information it considers reasonably necessary for the person's health care, section 54(2) requires the custodian to notify the recipient of that fact.

Section 39(1) bars a data controller or data processor from transferring personal information to a country or territory outside the Kingdom unless the Commission has given written consent to the transfer or the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection under section 40.

Section 39(2) disapplies that bar where the data subject has given and not withdrawn consent after being informed of the risks of transferring without adequate protection, or another listed situation applies. Section 40 sets out how adequacy is determined, and section 40(3) to (6) provides for the Commission's related designations, approvals and determinations. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Section 57(1) gives a person a right of access to a record of personal health information about them that is in the custody or under the control of a health information custodian, subject to the exceptions the section lists, including legal privilege, a prohibition in another Act or a court order, and a risk of serious harm. Section 57(2) extends the right of access to access in an electronic format that meets the requirements the Regulations prescribe.

Section 58(1) lets a person exercise the right by making a written request to the custodian that has custody or control of the information. Section 59(3) requires the custodian to respond to a request for access as soon as possible and no later than 30 days after receiving it.

Section 59(4) lets the custodian extend that limit by up to a further 30 days, on written notice to the person, where meeting it would unreasonably interfere with its operations or the consultations needed would make a timely reply not reasonably practical. If the custodian refuses a request for access in whole or in part, section 59(1)(c) requires a written notice giving the reason and stating that the person may complain to the Chief Executive Officer under Part 8.

Section 60(1) lets a person to whom access has been granted request in writing that the custodian correct a record they believe is inaccurate or incomplete. Section 60(2) requires the custodian to grant or refuse a correction request, or extend the deadline by up to 30 days in the cases it lists, by written notice no later than 30 days after receiving it.

Section 60(7) requires the custodian to grant a correction request if the person demonstrates, to its satisfaction, that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives it the information needed to correct the record.

If a custodian refuses a correction, section 60(10) requires it to give reasons and to tell the person that they may prepare a statement of disagreement, require the custodian to attach and disclose it, and complain to the Chief Executive Officer.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Section 44 gives a data subject the right not to be subject to a decision based solely on automated processing of personal information, including profiling, that produces legal or similarly significant effects concerning them, except where the decision is necessary for entering into or performing a contract, is authorized by a written law with suitable safeguards, or is authorized by the data subject's consent.

Section 33 requires a data controller collecting personal information directly from a data subject to tell them, at the time of collection, the controller's identity and contact details, that personal information is being collected, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and the intended recipients.

Section 42 gives a data subject the right to obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their personal information is being processed and its source, a copy in a commonly used electronic format, and correction or deletion of information that is inaccurate, out of date, incomplete or misleading or that the controller is not entitled to retain.

Section 43 lets a data subject stop direct marketing by written notice, which the controller must act on as soon as reasonably practicable and in any event within 30 days. Sections 45 and 46 give the rights to object to processing and to withdraw consent, and section 47 empowers the Minister to make regulations under section 68 to establish a right to portability of personal information. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Section 76(1) lets a person who has reasonable grounds to believe that another person has contravened or is about to contravene the Act or its Regulations make a complaint to the Chief Executive Officer responsible for health. Section 76(2) requires the complaint to be in writing and filed within one year after the subject-matter first came, or should reasonably have come, to the complainant's attention, or a longer period the Chief Executive Officer permits.

In a review, section 78(2) lets the Chief Executive Officer or an authorised officer demand production of relevant records and documents and inquire into a custodian's information practices. Section 79(1) lets the Chief Executive Officer, after a review, direct a person to perform a duty the Act imposes, to cease accessing, collecting, using or disclosing personal health information in contravention of the Act, or to change, cease or implement an information practice.

Section 79(1)(i) lets the Chief Executive Officer require a person who has contravened the Act or its Regulations to pay an administrative penalty, and section 80(2) provides that the amount is determined as prescribed in the Regulations. Section 81 lets a person affected by most of the Chief Executive Officer's directions appeal to the Minister within 21 days after receiving a copy, and then to the Supreme Court.

Section 87 bars anyone from dismissing, suspending, demoting, disciplining, harassing or otherwise disadvantaging a person for disclosing to the Chief Executive Officer that another person has contravened or is about to contravene the Act. Section 89(1) makes it an offence to wilfully access, collect, use or disclose personal health information in contravention of the Act, or wilfully to fail to comply with a direction of the Chief Executive Officer.

On conviction under section 89, a natural person is liable to a fine not exceeding $200,000 or imprisonment of not more than 7 years, or both, and a person who is not a natural person to a fine not exceeding $1,000,000.

Section 52 deems every omission or failure to comply with the Act, and every act contrary to it, a contravention. Section 54 lets a court order a pecuniary penalty for a contravention, capped by section 54(4) at TOP 5,000 for an individual's first contravention and, for a subsequent one, the greater of TOP 30,000 or three times the benefit obtained, and at TOP 30,000 for an organisation's or public authority's first contravention rising to TOP 100,000 for a subsequent one.

Section 55 lets the Commission serve an enforcement notice specifying the provisions it considers contravened and the reasons, section 56 provides for enforceable undertakings, and section 57 lets a data subject who has sustained loss or damage recover it by action, with the Commission able to bring the proceeding as representative of a class or to intervene. Sections 58 to 66 provide for information notices, investigation of complaints and the Commission's related powers.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

A health information custodian includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information in connection with its powers, duties or work. The Act binds the Crown, including all ministries, agencies and employees of the Crown.

Section 31 bars a custodian from collecting, using or disclosing personal health information about a person unless it has the person's consent under the Act and the collection, use or disclosure is necessary for a lawful purpose, or the Act permits or requires it. Section 32 bars a custodian from collecting, using or disclosing personal health information if other information will serve the purpose, and from collecting, using or disclosing more than is reasonably necessary to meet it.

Section 14(1) requires a custodian to take steps that are reasonable in the circumstances to protect personal health information in its custody or control against theft, loss and unauthorized access, use or disclosure. Section 10 requires a custodian that uses electronic means to handle personal health information to maintain an electronic audit log of each time a record is viewed, handled or modified, and to audit and monitor the log as often as the Regulations prescribe.

Section 40 requires a custodian to keep genetic test information that relates to a person in a separate record from the rest of the person's personal health information. Section 55 treats as sensitive personal health information what a person has identified to the custodian as sensitive, and information about genetic test information, HIV or AIDS, a sexually transmitted disease, a mental disorder, a pregnancy, or sexual assault or abuse.

Before disclosing sensitive personal health information, section 55(3) requires a custodian to inform the person to whom it relates, the recipient and why the disclosure is necessary, to consider the person's views and to note the record, though the duty to inform and consider views does not apply where the need is urgent, the disclosure is required by law or the person has consented.

Section 55(5) bars a custodian from disclosing sensitive personal health information if other personal health information will serve the same purpose.

Section 28 bars a data controller from processing sensitive personal information, or permitting a data processor to process it on its behalf, unless a section 27 condition has first been met and, in addition, the data subject has given and not withdrawn consent to the specific purpose, or the processing is necessary on one of the grounds the section lists, such as protecting the vital interests of a data subject who cannot consent.

Section 3 defines sensitive personal information to include biometric data.

Section 29 requires the consent of a parent or other appropriate legal guardian before processing the personal information of a child or an individual lacking legal capacity to consent, and requires appropriate mechanisms, including presentation of government approved identification documents, to verify age and consent, except where the processing is necessary to protect that person's vital interests or falls within the other exception the section states.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Section 6(1) makes it an offence for a person to cause unauthorised access to or modification of computer data, knowing the access or modification is unauthorised and intending to cause it. On conviction an individual faces a fine not exceeding $10,000, or imprisonment not exceeding 3 years, or both, and a corporation faces a fine not exceeding $50,000.

Under Section 5(1) access is unauthorised if the person is not entitled to cause it, and under Section 5(2) it is not unauthorised only because the person has an ulterior purpose for causing it. Section 2 defines access to computer data to include the display of the data by a computer system or any other output of the data from the computer system. The Act was passed by the Legislative Assembly on 14 May 2025. It carries the King's assent dated 28 August 2025.

Under Section 1(2) the Act comes into force on a date proclaimed by Cabinet. Cabinet proclaimed that the Act would come into force on 1 October 2025. Section 78(1) repeals the earlier Computer Crimes Act.

Section 4(1) provides that, in addition to the specific acts sections 5 to 9 separately address (causing confusion, damaging goodwill, misleading the public, discrediting an enterprise, and misusing secret information), any act or practice, in the course of industrial or commercial activities, that departs from fair dealing in commercial practice constitutes an act of unfair competition.

Section 4(2) preserves for any person damaged or likely to be damaged by an act of unfair competition the remedies obtainable under the general law of Tonga; the Act itself grants no cause of action and states no penalty or damages figure. The Act's own text records its commencement as 1 September 2008; the WIPO Lex database record for the same consolidated text separately lists an entry-into-force date of 1 October 2008, a discrepancy left unreconciled here.

Sections 11 to 14, 16 and 17 of the Cybersecurity Act 2025 let the Minister responsible for cybersecurity policy and regulation designate any physical, electronic or virtual infrastructure asset, system or network as critical infrastructure by publication in the Government Gazette, on grounds that include electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, and public safety or public health including emergency services.

A designated operator must register and keep the register current, comply with the Minister's minimum standards and submit to periodic or ad hoc audits, conduct and submit periodic cybersecurity self-assessments, comply with any order to take remedial, protective or preventative action, and develop, implement, communicate to staff, and keep records of policies and procedures for detecting, sharing information about, mitigating and responding to cybersecurity threats and incidents.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Paragraph 108 of Prudential Banking Standard No. 15 applies it to banks licensed under the Banking Act 2020 and makes it effective from 1 July 2021. Paragraph 1 of Prudential Banking Standard No. 15 requires a bank to have a framework for cybersecurity risk management, which should be an integral part of its enterprise risk management framework. Paragraph 2 of Prudential Banking Standard No. 15 requires the framework to be documented and approved by the Board and reviewed regularly.

Paragraph 3 of Prudential Banking Standard No. 15 requires a bank to have a designated cybersecurity risk management function. Paragraph 3(e) of Prudential Banking Standard No. 15 requires the function to be headed by a person designated as the Chief Information Security Officer or an equivalent senior officer. Paragraph 5 of Prudential Banking Standard No. 15 requires a bank to develop and document an enterprise wide cybersecurity risk strategy approved by the Board.

Paragraph 8 of Prudential Banking Standard No. 15 requires a bank to have in place a cybersecurity policy framework commensurate with its exposures to vulnerabilities and threats. Paragraph 103(a) of Prudential Banking Standard No. 15 requires a bank to conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production.

Paragraph 99 of Prudential Banking Standard No. 15 requires a bank to have a cybersecurity incident management process governed by documented policy and procedures. Paragraph 107 of Prudential Banking Standard No. 15 provides that non-compliance with it is subject to corrective actions as provided under section 39 of the Banking Act 2020. Prudential Banking Standard No. 15 states that it is issued under section 20(3) of the Banking Act 2020.

Section 19(3) of the Banking Act 2020 allows the Reserve Bank to issue in writing prudential banking standards. Section 39(1)(a) of the Banking Act 2020 allows the Reserve Bank to impose the measures in that section where a bank contravenes a prudential banking standard.

Section 39(3) of the Banking Act 2020 allows the Reserve Bank to issue written warnings, enter into a written agreement with the board of directors of the bank providing for a program of remedial action, and issue written orders to cease and desist.

Section 15 requires an operator of critical infrastructure designated under section 11 to report a cybersecurity incident to the Computer Emergency Response Team (CERT) within 24 hours of becoming aware of it, whether the incident affects the information systems of the designated infrastructure itself, any information system interconnected with or communicating with those systems, or any other incident the Minister responsible for cybersecurity policy and regulation has designated as requiring notification, in a form that Minister prescribes.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.

Paragraph 105 of Prudential Banking Standard No. 15 requires a bank to provide quarterly reporting on all cybersecurity incidents in the format prescribed in Appendix I. Paragraph 106 of Prudential Banking Standard No. 15 requires a bank to notify the National Reserve Bank of Tonga as soon as possible but not later than sixty minutes after becoming aware of an information security incident that materially affects or has the potential to materially affect the institution or the interests of depositors.

Paragraph 107 of Prudential Banking Standard No. 15 provides that non-compliance with it is subject to corrective actions as provided under section 39 of the Banking Act 2020. Section 39(1)(a) of the Banking Act 2020 allows the Reserve Bank to impose the measures in that section where a bank contravenes a prudential banking standard.

Section 13(a) permits reproducing, in a newspaper or periodical, or broadcasting or otherwise communicating to the public, an article published in a newspaper or periodical on current economic, political, or religious topics, or a broadcast work of the same character, without the author's authorisation, unless the right to authorise that reproduction has been expressly reserved on the copies or acknowledged in connection with an earlier broadcast of the work.

Section 10 separately permits reproducing, in the form of quotation, a short part of any published work without authorisation, provided the reproduction is compatible with fair practice, does not exceed the extent justified by the purpose, and is accompanied by an indication of source and the author's name.

Neither section carries a numeric length cap, and going beyond either exception's fair-practice and extent-justified limits exposes the reproducer to the Act's ordinary infringement remedies, including a criminal fine of up to $20,000 or imprisonment of up to three years under section 29.