Tonga

Section 4 binds the State, and section 5 applies the Act to a data controller or data processor established in Tonga, processing within Tonga, or targeting or monitoring a Tongan data subject.

Section 27 requires a lawful basis, ordinarily the data subject's specific and informed consent, before personal information may be processed, and section 28 requires a heightened basis, such as explicit consent or a proportionate substantial-public-interest law, before sensitive personal information (including biometric data, racial or ethnic origin, political opinions, religious belief, health, sexual orientation, criminal or financial record, or genetic information) may be processed.

Section 29 requires a parent's or guardian's consent and government-approved age and consent verification before processing a child's personal information, subject to vital-interest and medical-care exceptions. Section 33 requires notice to a data subject at collection of the controller's identity, the purpose of collection, whether sensitive personal information or overseas disclosure is involved, and the data subject's rights; section 34 limits retention to what is necessary for that purpose.

Section 36 requires appropriate technical and organisational security measures, and section 37 requires notifying the Privacy Commission of a personal information breach likely to risk a data subject's rights within seventy-two hours of becoming aware of it, and notifying the affected data subject directly where the risk is high; section 37(11) states that the breach-notification duty does not apply until the second anniversary of the Act's commencement date.

Sections 39 and 40 bar transferring personal information outside Tonga unless the Privacy Commission has given written consent, the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct, or a certification mechanism affording adequate protection, or a specific exception (such as the data subject's informed consent) applies.

Part IV gives a data subject the right to access, correct, and delete their personal information, to stop its use for direct marketing, to object to certain processing, to withdraw consent, and not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect, subject to stated exceptions; section 47 makes a right to data portability available only once the Minister makes regulations creating it.

Section 48 exempts information already published in a generally available publication or permanently de-identified, though section 48(2) keeps information collected before that publication within the Act; sections 49 and 50 exempt purely personal or household processing, defined public-authority purposes such as national security and criminal investigation, journalism under a published privacy code, and processing connected with legal proceedings or professional privilege.

A new Privacy Commission, established by section 7 and headed by a Privacy Commissioner, investigates complaints, issues enforcement notices and information notices, accepts enforceable undertakings, and may bring civil proceedings under section 54 for a pecuniary penalty; section 57 separately lets a data subject who suffers loss or damage from a contravention sue for it directly.

Section 1(2) states that the Act comes into force on a date proclaimed by Cabinet rather than automatically upon assent; press reporting (Tonga Independent News, 6 January 2026) states the Act was gazetted into force alongside a package of other 2025 governance-reform statutes, but the Cabinet proclamation itself, which would fix the exact commencement date, is not confirmed in the primary text, so the Act's status is recorded here as enacted rather than as confirmed in force.

Section 4(2) makes it an offence for a person to wilfully, without lawful excuse, access any computer system, on conviction to a fine not exceeding $10,000 or imprisonment not exceeding two years, or both; unlike some other jurisdictions' computer-misuse statutes, the offence does not require that the accused defeat a security measure to gain access.

Section 4(3) sets a materially higher penalty, a fine not exceeding $100,000 or imprisonment not exceeding twenty years, or both, where the computer accessed is a 'protected computer' tied to security, defence, or international relations; the identity of a confidential law-enforcement source; communications, banking, financial, public-utility, transport, or public-key infrastructure; or public-safety and emergency services, and the accused knew or ought reasonably to have known of that use.

Section 4(1) provides that, in addition to the specific acts sections 5 to 9 separately address (causing confusion, damaging goodwill, misleading the public, discrediting an enterprise, and misusing secret information), any act or practice, in the course of industrial or commercial activities, that departs from fair dealing in commercial practice constitutes an act of unfair competition.

Section 4(2) entitles any person damaged or likely to be damaged by an act of unfair competition to the remedies obtainable under the general law of Tonga, without stating a fixed statutory penalty or damages figure of its own. The Act's own text records its commencement as 1 September 2008; the WIPO Lex database record for the same consolidated text separately lists an entry-into-force date of 1 October 2008, a discrepancy left unreconciled here.

Section 13(a) permits reproducing, in a newspaper or periodical, or broadcasting or otherwise communicating to the public, an article published in a newspaper or periodical on current economic, political, or religious topics, or a broadcast work of the same character, without the author's authorisation, unless the right to authorise that reproduction has been expressly reserved on the copies or acknowledged in connection with an earlier broadcast of the work.

Section 10 separately permits reproducing, in the form of quotation, a short part of any published work without authorisation, provided the reproduction is compatible with fair practice, does not exceed the extent justified by the purpose, and is accompanied by an indication of source and the author's name.

Neither section carries a numeric length cap, and going beyond either exception's fair-practice and extent-justified limits exposes the reproducer to the Act's ordinary infringement remedies, including a criminal fine of up to $20,000 or imprisonment of up to three years under section 29.