TongaPrivacy Act 2025, penalties, enforcement and third party actions
Privacy Act 2025, ss. 52-66 (penalties, enforcement and investigation)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- This law is recorded as enacted, but the Cabinet proclamation that would fix its commencement date under section 1(2) has not been located, so whether it is yet in force has to be established before relying on what follows.
- Expect a court to be able to order a pecuniary penalty for a contravention: up to TOP 30,000 for an organisation's first contravention and TOP 100,000 for a subsequent one, and up to TOP 5,000 for an individual's first contravention.
- Comply with an enforcement notice the Privacy Commission serves on you, and with an information notice in an investigation.
- Expect a data subject who has sustained loss or damage from your contravention to recover it by action, and the Commission to be able to bring that proceeding for a class of affected people.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 54(4) sets four separate caps rather than one: an individual's first contravention is capped at TOP 5,000, an individual's subsequent contravention at the greater of TOP 30,000 or three times the value of the benefit obtained from the contravention, an organisation's or public authority's first contravention at TOP 30,000, and a subsequent contravention by an organisation or public authority at TOP 100,000. The court fixes the actual amount within the applicable cap having regard to the nature and extent of the contravention and any prior findings against the same data controller or data processor. The Act states these figures in dollars, understood here as Tongan pa'anga.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- TOP
- Fixed cap
- 30,000
Who enforces it
Enforcement body
Privacy Commission
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 52 deems every omission or failure to comply with the Act, and every act contrary to it, a contravention. Section 54 lets a court order a pecuniary penalty for a contravention, capped by section 54(4) at TOP 5,000 for an individual's first contravention and, for a subsequent one, the greater of TOP 30,000 or three times the benefit obtained, and at TOP 30,000 for an organisation's or public authority's first contravention rising to TOP 100,000 for a subsequent one.
Section 55 lets the Commission serve an enforcement notice specifying the provisions it considers contravened and the reasons, section 56 provides for enforceable undertakings, and section 57 lets a data subject who has sustained loss or damage recover it by action, with the Commission able to bring the proceeding as representative of a class or to intervene. Sections 58 to 66 provide for information notices, investigation of complaints and the Commission's related powers.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet, and no proclamation has been located, so whether these provisions bind today is not established.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometrics
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.