Tonga Privacy Act 2025
Tonga's Privacy Act 2025 (Act 34 of 2025), the Kingdom's first general data protection law: what data controllers and processors, public and private, must do on lawful basis, sensitive data, notices, retention, processors, security, 72 hour breach notification, cross-border transfers and data subject rights, enforced by a new Privacy Commission. Enacted and assented in December 2025; in force on a date Cabinet proclaims. Built from the Act read in full.
Tonga Privacy Act 2025 is a compliance framework from Tonga with 3 domains and 17 controls. The largest domains are Part III: obligations of data controllers and data processors – Tonga Privacy Act 2025 (12 controls), Part IV: rights of data subjects – Tonga Privacy Act 2025 (4 controls), Part VI: cooperation with enforcement – Tonga Privacy Act 2025 (1 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Part III: obligations of data controllers and data processors – Tonga Privacy Act 2025
| Code | Title |
|---|---|
| tonga-privacy-act-2025::s27 | s.27 Process personal information only on a listed lawful basis |
| tonga-privacy-act-2025::s28 | s.28 Meet an additional condition before processing sensitive personal information |
| tonga-privacy-act-2025::s29 | ss.29, 31 Get parental consent for children, verify age, and be able to prove consent |
| tonga-privacy-act-2025::s32 | s.32 Limit purpose, keep data accurate and minimal, and control further use |
| tonga-privacy-act-2025::s33 | s.33 Tell data subjects the prescribed information when collecting their data |
| tonga-privacy-act-2025::s34 | s.34 Keep personal information no longer than necessary, then return, destroy or de-identify it |
| tonga-privacy-act-2025::s35 | s.35 Bind data processors, normally by written agreement |
| tonga-privacy-act-2025::s36 | s.36 Secure personal information with risk-based technical and organisational measures |
| tonga-privacy-act-2025::s37 | s.37 Notify personal information breaches within 72 hours (from two years after commencement) |
| tonga-privacy-act-2025::s38 | s.38 Carry out privacy impact assessments for high-risk processing when regulations require |
| tonga-privacy-act-2025::s39 | ss.39, 40 Transfer personal information abroad only with adequate protection, consent or another listed ground |
| tonga-privacy-act-2025::s41 | s.41 Maintain privacy policies, a complaints process and staff awareness, and share them on request |
Part IV: rights of data subjects – Tonga Privacy Act 2025
| Code | Title |
|---|---|
| tonga-privacy-act-2025::s42 | s.42 Give data subjects confirmation, a copy, correction and deletion free of charge |
| tonga-privacy-act-2025::s43 | s.43 Stop direct marketing on written request within 30 days |
| tonga-privacy-act-2025::s44 | ss.44, 45 Respect limits on solely automated decisions and handle objections |
| tonga-privacy-act-2025::s46 | ss.46, 47 Make consent as easy to withdraw as to give, and prepare for portability rules |
Part VI: cooperation with enforcement – Tonga Privacy Act 2025
| Code | Title |
|---|---|
| tonga-privacy-act-2025::s55 | ss.55, 56, 58, 59, 61(5) Comply with information notices, enforcement notices, undertakings and warrants |
What is Tonga Privacy Act 2025 and who does it apply to?
Tonga Privacy Act 2025 is a compliance framework from Tonga with 3 domains and 17 controls. Tonga's Privacy Act 2025 (Act 34 of 2025), the Kingdom's first general data protection law: what data controllers and processors, public and private, must do on lawful basis, sensitive data, notices, retention, processors, security, 72 hour breach notification, cross-border transfers and data subject rights, enforced by a new Privacy Commission. Enacted and assented in December 2025; in force on a date Cabinet proclaims. Built from the Act read in full. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Tonga Privacy Act 2025 actually require?
Tonga Privacy Act 2025 has 17 controls organised across 3 domains. The largest domains are Part III: obligations of data controllers and data processors – Tonga Privacy Act 2025 (12 controls), Part IV: rights of data subjects – Tonga Privacy Act 2025 (4 controls), Part VI: cooperation with enforcement – Tonga Privacy Act 2025 (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Tonga Privacy Act 2025 do I already cover?
Tonga Privacy Act 2025 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Tonga Privacy Act 2025?
Start your Tonga Privacy Act 2025 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Tonga Privacy Act 2025 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 17 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 705 frameworks.
Get Started Free →Free forever — no credit card required