TongaPrivacy Act 2025, sensitive personal information and children
Privacy Act 2025, ss. 28-29 (sensitive personal information and children)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- This law is recorded as enacted, but the Cabinet proclamation that would fix its commencement date under section 1(2) has not been located, so whether it is yet in force has to be established before relying on what follows.
- Do not process sensitive personal information, including biometric data such as a voiceprint or facial image, unless a section 27 basis is met and, in addition, the data subject has given and not withdrawn consent to that specific purpose or another section 28 ground applies.
- Before processing a child's personal information, or that of an individual lacking capacity to consent, obtain the consent of a parent or other appropriate legal guardian and apply appropriate age and consent verification mechanisms, including government approved identification documents.
What it reaches
Obligation class
Consent, Biometric, Age verification
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 28 bars a data controller from processing sensitive personal information, or permitting a data processor to process it on its behalf, unless a section 27 condition has first been met and, in addition, the data subject has given and not withdrawn consent to the specific purpose, or the processing is necessary on one of the grounds the section lists, such as protecting the vital interests of a data subject who cannot consent.
Section 3 defines sensitive personal information to include biometric data.
Section 29 requires the consent of a parent or other appropriate legal guardian before processing the personal information of a child or an individual lacking legal capacity to consent, and requires appropriate mechanisms, including presentation of government approved identification documents, to verify age and consent, except where the processing is necessary to protect that person's vital interests or falls within the other exception the section states.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.