Cybersecurity Act 2025, Critical Infrastructure Operator Obligations

Act 14 of 2025, ss. 11-14, 16-17

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sector security regimes rule binding public and private bodies.

As of 19 September 2026.

What it requires

This duty does not yet bind: the Cybersecurity Act 2025 comes into force only on a date proclaimed by Cabinet under section 1(2), and no proclamation has been identified.
It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette; grounds for designation include infrastructure necessary for electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, or public safety and public health including emergency services.
Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.
Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.
Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Section 19(3) sets two separate fixed ceilings by class of contravener: not exceeding $500,000 for an individual and not exceeding $1,000,000 for a body corporate; the higher, body-corporate figure is recorded as fixed_cap. The Act does not define the currency the bare "$" denotes; Tonga's legal tender is the Pa'anga (ISO 4217: TOP), confirmed on the National Reserve Bank of Tonga's own site (reservebank.to); that currency is recorded here in the absence of an express definition in the Act itself. The amount is a court-ordered civil pecuniary penalty recovered through a civil action the Attorney General institutes under section 18, not a fixed administrative fine or a criminal sentence: section 19(2) directs the court to set the amount for each contravention having regard to its nature and extent, any resulting loss or damage, the circumstances, and any prior finding of similar conduct by the same operator, up to the applicable ceiling.

Rule: Fixed only
As of: 19 September 2026
Currency: TOP
Fixed cap: 1,000,000

Who enforces it

Enforcement body

The Attorney General, who may institute civil proceedings in a court of competent jurisdiction against an operator of critical infrastructure for a pecuniary penalty; the Minister responsible for cybersecurity policy and regulation (Minister CPR) administers registration, standards, audits, and remedial-action orders under Part V.

Settledness

As of

19 September 2026

Open questions

Has Cabinet proclaimed a commencement date for the Cybersecurity Act 2025 under section 1(2), and if so what is it?
Which infrastructure assets, systems or networks, if any, has the Minister responsible for cybersecurity policy and regulation designated as critical infrastructure under section 11, since every duty in this instrument binds only an operator so designated?
Does the pecuniary-penalty cap in section 19(3), stated only as "$500,000" and "$1,000,000", denote the Tongan Pa'anga or another currency?

What it reaches

Obligation class

Governance, Reporting, Security

Applicability criteria

The Act itself is not yet in force: section 1(2) makes commencement conditional on a date proclaimed by Cabinet, so this criterion cannot yet be satisfied by anyone.

As of: 19 September 2026
Combinator: All of
Criteria: The Minister responsible for cybersecurity policy and regulation has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 of the Cybersecurity Act 2025, and published that designation in the Government Gazette.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Sections 11 to 14, 16 and 17 of the Cybersecurity Act 2025 let the Minister responsible for cybersecurity policy and regulation designate any physical, electronic or virtual infrastructure asset, system or network as critical infrastructure by publication in the Government Gazette, on grounds that include electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, and public safety or public health including emergency services.

A designated operator must register and keep the register current, comply with the Minister's minimum standards and submit to periodic or ad hoc audits, conduct and submit periodic cybersecurity self-assessments, comply with any order to take remedial, protective or preventative action, and develop, implement, communicate to staff, and keep records of policies and procedures for detecting, sharing information about, mitigating and responding to cybersecurity threats and incidents.

When LexLint raises it

operates_essential_service
provides_financial_services
provides_telecom_services
handles_health_records

Read the law

Official Act text (Cybersecurity Act 2025, Act 14 of 2025), Attorney General's Office of Tonga, as captured in the Internet Archive
the publisher's own host presents an automated bot-verification challenge on the direct PDF

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app