TongaPrivacy Act 2025, transfers of personal information outside the Kingdom
Privacy Act 2025, ss. 39-41 (transfers outside the Kingdom)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A cross border transfer rule binding public and private bodies.
As of 19 September 2026.
What it requires
- This law is recorded as enacted, but the Cabinet proclamation that would fix its commencement date under section 1(2) has not been located, so whether it is yet in force has to be established before relying on what follows.
- Do not transfer personal information outside Tonga unless the Privacy Commission has consented in writing, or the recipient is bound by a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection.
- Where you rely on the data subject's consent to transfer without adequate protection, inform them of the risks first and stop if they withdraw it.
What it reaches
Obligation class
Transfer
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 39(1) bars a data controller or data processor from transferring personal information to a country or territory outside the Kingdom unless the Commission has given written consent to the transfer or the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection under section 40.
Section 39(2) disapplies that bar where the data subject has given and not withdrawn consent after being informed of the risks of transferring without adequate protection, or another listed situation applies. Section 40 sets out how adequacy is determined and section 41 provides for the related determinations. Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.