Privacy Act 2025, notification to data subjects and rights of data subjects

Privacy Act 2025, ss. 33 and 42-47 (notification and rights)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

This law is recorded as enacted, but the Cabinet proclamation that would fix its commencement date under section 1(2) has not been located, so whether it is yet in force has to be established before relying on what follows.
At the time you collect personal information, tell the data subject your identity and contact details, that you are collecting it, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and who the intended recipients are.
On request, confirm whether you process a data subject's personal information and where it came from, give them a copy in a commonly used electronic format, and correct or delete information that is inaccurate, out of date, incomplete or misleading, without constraint or unreasonable delay and at no expense.
Act on a written request to stop processing personal information for direct marketing as soon as reasonably practicable, and in any event within 30 days of receiving it.
Let a data subject object to processing, withdraw consent, obtain their personal information in a portable form, and avoid a decision based solely on automated processing.

What it reaches

Obligation class

Disclosure, Data subject rights

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 33 requires a data controller collecting personal information directly from a data subject to tell them, at the time of collection, the controller's identity and contact details, that personal information is being collected, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and the intended recipients.

Section 42 gives a data subject the right to obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their personal information is being processed and its source, a copy in a commonly used electronic format, and correction or deletion of information that is inaccurate, out of date, incomplete or misleading or that the controller is not entitled to retain.

Section 43 lets a data subject stop direct marketing by written notice, which the controller must act on as soon as reasonably practicable and in any event within 30 days. Sections 44 to 47 give the rights not to be subject to a decision based solely on automated processing, to object to processing, to withdraw consent and to portability.

Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.

When LexLint raises it

high_risk_decisions
automated_outreach
deploys_chatbot
crawls_web
trains_models

Read the law

Official English text, Privacy Act 2025 (Act 34 of 2025), Tonga Attorney General's Office legislation database, archived copy

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app