Tonga

Section 37(1) requires a data processor that becomes aware of a personal information breach to notify the data controller or the data processor that engaged it within seventy-two hours, describing the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, and to respond without undue delay to information requests from whoever engaged it.

Section 37(2) requires a data controller to notify the Commission within seventy-two hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals, with the same description.

Section 37(3) requires the controller to communicate a breach likely to result in a high risk to a data subject to that data subject without undue delay, in plain and clear language, with advice on measures they could take to mitigate the adverse effects, and allows a public communication through widely used media where direct communication would involve disproportionate effort or expense.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.

Section 27 bars a data controller from processing personal information, or permitting a data processor to do so on its behalf, except on a lawful basis it lists, beginning with the data subject's consent to the specific purpose and running through contractual necessity, a legal obligation, vital interests and the public interest.

Section 31 governs reliance on consent and section 32 requires processing to be for a lawful purpose related to the controller's function or activity, personal information to be accurate, complete, not misleading and up to date to the extent the purpose requires, and the information held to be adequate, relevant and limited to that purpose.

Section 34 bars retention for longer than the purpose requires and requires the information to be returned, destroyed, rendered inaccessible or permanently de-identified within a reasonable time once retention is no longer necessary.

Section 35 governs the engagement of a data processor, section 36 requires appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction, damage or access, and section 38 lets the Minister make regulations requiring a personal information protection impact assessment for high-risk processing.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established. Separately, press reporting (Tonga Independent News, 6 January 2026) states the Act was gazetted into force alongside a package of other 2025 governance-reform statutes, and no Cabinet proclamation confirming that has been located.

Section 39(1) bars a data controller or data processor from transferring personal information to a country or territory outside the Kingdom unless the Commission has given written consent to the transfer or the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection under section 40.

Section 39(2) disapplies that bar where the data subject has given and not withdrawn consent after being informed of the risks of transferring without adequate protection, or another listed situation applies. Section 40 sets out how adequacy is determined and section 41 provides for the related determinations. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.

Section 33 requires a data controller collecting personal information directly from a data subject to tell them, at the time of collection, the controller's identity and contact details, that personal information is being collected, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and the intended recipients.

Section 42 gives a data subject the right to obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their personal information is being processed and its source, a copy in a commonly used electronic format, and correction or deletion of information that is inaccurate, out of date, incomplete or misleading or that the controller is not entitled to retain.

Section 43 lets a data subject stop direct marketing by written notice, which the controller must act on as soon as reasonably practicable and in any event within 30 days. Sections 44 to 47 give the rights not to be subject to a decision based solely on automated processing, to object to processing, to withdraw consent and to portability.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.

Section 52 deems every omission or failure to comply with the Act, and every act contrary to it, a contravention. Section 54 lets a court order a pecuniary penalty for a contravention, capped by section 54(4) at TOP 5,000 for an individual's first contravention and, for a subsequent one, the greater of TOP 30,000 or three times the benefit obtained, and at TOP 30,000 for an organisation's or public authority's first contravention rising to TOP 100,000 for a subsequent one.

Section 55 lets the Commission serve an enforcement notice specifying the provisions it considers contravened and the reasons, section 56 provides for enforceable undertakings, and section 57 lets a data subject who has sustained loss or damage recover it by action, with the Commission able to bring the proceeding as representative of a class or to intervene. Sections 58 to 66 provide for information notices, investigation of complaints and the Commission's related powers.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.

Section 28 bars a data controller from processing sensitive personal information, or permitting a data processor to process it on its behalf, unless a section 27 condition has first been met and, in addition, the data subject has given and not withdrawn consent to the specific purpose, or the processing is necessary on one of the grounds the section lists, such as protecting the vital interests of a data subject who cannot consent.

Section 3 defines sensitive personal information to include biometric data.

Section 29 requires the consent of a parent or other appropriate legal guardian before processing the personal information of a child or an individual lacking legal capacity to consent, and requires appropriate mechanisms, including presentation of government approved identification documents, to verify age and consent, except where the processing is necessary to protect that person's vital interests or falls within the other exception the section states.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.

Section 4(2) makes it an offence for a person to wilfully, without lawful excuse, access any computer system, on conviction to a fine not exceeding $10,000 or imprisonment not exceeding two years, or both; unlike some other jurisdictions' computer-misuse statutes, the offence does not require that the accused defeat a security measure to gain access.

Section 4(3) sets a materially higher penalty, a fine not exceeding $100,000 or imprisonment not exceeding twenty years, or both, where the computer accessed is a 'protected computer' tied to security, defence, or international relations; the identity of a confidential law-enforcement source; communications, banking, financial, public-utility, transport, or public-key infrastructure; or public-safety and emergency services, and the accused knew or ought reasonably to have known of that use.

Section 4(1) provides that, in addition to the specific acts sections 5 to 9 separately address (causing confusion, damaging goodwill, misleading the public, discrediting an enterprise, and misusing secret information), any act or practice, in the course of industrial or commercial activities, that departs from fair dealing in commercial practice constitutes an act of unfair competition.

Section 4(2) entitles any person damaged or likely to be damaged by an act of unfair competition to the remedies obtainable under the general law of Tonga, without stating a fixed statutory penalty or damages figure of its own. The Act's own text records its commencement as 1 September 2008; the WIPO Lex database record for the same consolidated text separately lists an entry-into-force date of 1 October 2008, a discrepancy left unreconciled here.

Sections 11 to 14, 16 and 17 of the Cybersecurity Act 2025 let the Minister responsible for cybersecurity policy and regulation designate any physical, electronic or virtual infrastructure asset, system or network as critical infrastructure by publication in the Government Gazette, on grounds that include electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, and public safety or public health including emergency services.

A designated operator must register and keep the register current, comply with the Minister's minimum standards and submit to periodic or ad hoc audits, conduct and submit periodic cybersecurity self-assessments, comply with any order to take remedial, protective or preventative action, and develop, implement, communicate to staff, and keep records of policies and procedures for detecting, sharing information about, mitigating and responding to cybersecurity threats and incidents.

Section 15 requires an operator of critical infrastructure designated under section 11 to report a cybersecurity incident to the Computer Emergency Response Team (CERT) within 24 hours of becoming aware of it, whether the incident affects the information systems of the designated infrastructure itself, any information system interconnected with or communicating with those systems, or any other incident the Minister responsible for cybersecurity policy and regulation has designated as requiring notification, in a form that Minister prescribes.

Section 13(a) permits reproducing, in a newspaper or periodical, or broadcasting or otherwise communicating to the public, an article published in a newspaper or periodical on current economic, political, or religious topics, or a broadcast work of the same character, without the author's authorisation, unless the right to authorise that reproduction has been expressly reserved on the copies or acknowledged in connection with an earlier broadcast of the work.

Section 10 separately permits reproducing, in the form of quotation, a short part of any published work without authorisation, provided the reproduction is compatible with fair practice, does not exceed the extent justified by the purpose, and is accompanied by an indication of source and the author's name.

Neither section carries a numeric length cap, and going beyond either exception's fair-practice and extent-justified limits exposes the reproducer to the Act's ordinary infringement remedies, including a criminal fine of up to $20,000 or imprisonment of up to three years under section 29.