Data protection & privacy laws in Tonga (2026)

The Privacy Act 2025 (Act 34 of 2025) received Royal Assent on 16 December 2025 and was published in the Government Gazette as part of a broader legislative reform package. The text is available in both Tongan and English through the Attorney General's Office.

The Act shall come into force on a date proclaimed by Cabinet, meaning full operational effect had not been automatically triggered at the point of Royal Assent. Until Cabinet proclaims a commencement date, enforcement mechanisms remain pending.

The Act establishes the Privacy Commission as an independent supervisory body. The Commissioner is not subject to the Public Service Act and is shielded from personal liability for acts done in exercise of their statutory functions. A Privacy Commission Fund supports its operations.

Controllers must process personal information in accordance with statutory data-protection principles covering lawful basis, consent, data minimisation, retention, security, and engagement of data processors. Standards for cross-border transmission of personal information outside the Kingdom are also set.

Data subjects are granted rights with respect to the processing of their personal information, including the right to data portability. Enforcement mechanisms include the right to lodge complaints with the Privacy Commission, investigation powers, enforcement notices, and pecuniary penalties for contraventions.

The Personal Health Information Protection Act 2025 was enacted alongside the Privacy Act 2025 to provide additional protections for medical and health information, reflecting a layered approach to sensitive-data categories.