The framework
Tonga has enacted the Privacy Act 2025 (Act 34 of 2025), but the regime is not yet fully operative.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Privacy Act 2025 (Act 34 of 2025)
Tonga's Privacy Act 2025 received royal assent on 16 December 2025, a comprehensive law that also reaches organizations outside Tonga that target people there. It starts on a date proclaimed by Cabinet, reports conflict on whether that has happened, and no Privacy Commissioner has been announced.
Marketing and advertising
Comprehensive framework for controllers and processors based in Tonga or targeting people there; commencement is by Cabinet proclamation. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
The Act regulates transfers abroad once it commences. In practice, the binding transfer rules for most international campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
The Act provides for penalties; breach notification duties apply only two years after commencement.