Think about how much of your life is written down somewhere. Your details at the bank. Your medical history at the clinic. Your face on a shop's security camera. Your location, logged every time you open an app.
The Privacy Act 2025 sets out rules about how that information may be collected, used, stored and shared. It gives individuals rights over information about them, places obligations on the organisations holding it, and establishes a Privacy Commission to oversee those rules. It was passed by the Legislative Assembly on 6 August 2025 and received Royal Assent on 16 December 2025.
Is the Privacy Act 2025 in force yet?
Not yet. Section 1(2) says the Act comes into force on a date proclaimed by Cabinet, and no such proclamation has been published so far as we can tell.
So the law has been made, but the day it starts to bite is a separate decision still to come. Everything below is what the Act will require once that happens.
What counts as personal information
Broader than many people assume. The Act covers information relating to a person who can be identified, directly or indirectly, and the definition expressly includes a name, an identification number, location data and an online identifier. It is not only the paper file at the office. It extends to the digital trail as well.
The Act then creates a category of sensitive personal information attracting extra requirements. It includes biometric data, racial or ethnic origin, political opinions, religious beliefs, physical or mental health, sexual orientation, criminal or financial record, and genetic information.
Did you know? The Act's definition of biometric data expressly includes neurodata processing, meaning information derived from brain activity. It sits alongside more familiar examples such as facial images, fingerprinting, voice recognition and DNA analysis.
Your privacy rights in Tonga
Once the Act is in force, you will be able to:
Ask an organisation whether it holds information about you and where it came from, and request a copy. Where producing the copy would impose unreasonable costs, the organisation may require you to meet some or all of them.
Require correction of information that is inaccurate, out of date, incomplete or misleading, and deletion of information the organisation is not entitled to keep.
Stop direct marketing by written notice. The organisation must act within 30 days at the latest.
Avoid decisions made solely by automated processing, including profiling, where those decisions have legal or similarly significant effects, subject to exceptions.
Withdraw consent at any time, and the Act requires that this be as easy as giving it. Complaints to the Privacy Commission carry no fee.
What businesses and organisations must do
Have a lawful basis. Personal information may only be processed on one of the grounds the Act sets out. Consent is one. Others include performance of a contract, compliance with a legal obligation, and legitimate interests not overridden by the person's rights. Sensitive information requires an additional ground.
Tell people. At collection, organisations must generally say who is collecting the information, what is being collected, why, and who will receive it. People must also be told if their information is likely to go overseas and, where practicable, to which countries.
Keep only what is needed. Information must be limited to the minimum necessary and not kept longer than necessary. Once it is no longer needed it must be returned, destroyed, permanently de-identified or rendered permanently inaccessible, subject to exceptions.
Keep it secure. Organisations must put appropriate technical and organisational measures in place, identify foreseeable risks, build safeguards, and check they work. They must also maintain privacy policies and a complaints process, and make information about these available to the public on request.
Did you know? If a question arises about whether someone consented, the Act places the burden of proof on the organisation, not on the individual.
Data breaches and sending information overseas
Where a breach is likely to result in a risk to people's rights and freedoms, the organisation must notify the Privacy Commission within 72 hours of becoming aware of it. Where the risk is high, affected individuals must also be told without undue delay, in plain language, with advice on what they can do.
Did you know? The breach notification section does not apply until the second anniversary of the commencement date. The Act builds in a two year lead-in for this obligation.
Sending personal information outside Tonga is restricted. It generally requires either the written consent of the Commission or a recipient subject to arrangements affording an adequate level of protection, with exceptions including informed consent and contractual necessity. This matters for cloud storage, offshore payroll and overseas platforms.
Penalties, and who the Act applies to
The Commission may investigate on complaint or on its own motion and issue enforcement notices. A court may order pecuniary penalties, with a maximum for an individual of $5,000 for a first contravention, and for an organisation or public authority $30,000 for a first contravention and $100,000 for a subsequent one. A person who suffers loss or damage may also bring an action to recover it.
The Act binds the State, so ministries, government departments, the courts and Tonga Police are covered. It does not apply to information handled purely for personal, family or household purposes, or to information already published or permanently de-identified, and there are carve-outs for national security, law enforcement and journalism. It can also reach organisations outside Tonga that target goods or services at people here, or monitor their behaviour here.
Where to from here
For individuals, the Act is a reason to start asking what your details are being used for and where they end up.
For organisations, the time before commencement is the easy window. Work out what information you hold, why you use it, how long you keep it, where it goes, and what you would actually do in the first 72 hours after a breach. What that looks like in practice will differ a good deal from one organisation to the next.
Questions people are asking
When does the Privacy Act 2025 take effect in Tonga? On a date proclaimed by Cabinet under section 1(2). It has been passed and assented to, but the commencement date is a separate step.
Does the Privacy Act 2025 apply to government? Yes. The Act binds the State, and ministries, government departments, the courts and Tonga Police all fall within it.
Does it apply to small businesses? There is no general small business exemption. What matters is whether you collect or use personal information, not how large you are.
Can I be fined under the Privacy Act 2025? A court may order pecuniary penalties, up to $5,000 for an individual's first contravention and up to $30,000 for an organisation's first contravention, rising for repeat contraventions.
Does it cover information sent overseas? Yes. Transfers of personal information out of Tonga are restricted unless the Commission consents or the recipient is subject to arrangements affording adequate protection.
Comments 0
Be the first to share a thoughtful response.