Papua New Guinea: technology regulation at a glance

Framework: No dedicated crypto/digital-asset legislation; Bank of Papua New Guinea Act, Capital Market Act 2015, and Securities Commission Act 2015 provide partial coverage; Income Tax Act 2025 (in force 1 January 2026) introduces limited capital-gains tax regime; FATF Mutual Evaluation 2024 (APG) identifies AML/CFT deficiencies including gaps in VASP oversight

Papua New Guinea has no statute that explicitly bans or comprehensively regulates crypto assets; virtual currencies occupy a legal gray area and lack legal-tender status under the Bank of Papua New Guinea Act. The BPNG completed a Digital Kina CBDC proof of concept in January 2025 and is weighing a broader rollout pending legal reforms, while PNG remains under FATF increased monitoring as of February 2026, with an action plan requiring improved VASP supervision. The Securities Commission of Papua New Guinea's Capital Market Act 2015 theoretically covers crypto assets as tradeable instruments, but no secondary rules or licensing requirements for exchanges or token issuers have been issued.

Framework: Draft Government AI Adoption Framework (February 2026) and Draft National Sovereign Digital Transformation and AI Strategy (March 2026), overseen by the Department of Information and Communications Technology (DICT). A proposed National Artificial Intelligence Act is planned but not yet enacted.

Papua New Guinea has no AI-specific law or binding AI regulation in force as of May 2026. The government released two draft documents for public consultation in early 2026, the Government AI Adoption Framework (February) and the National Sovereign Digital Transformation and AI Strategy (March), both outlining a risk-based, data-sovereignty-centred approach. Dedicated legislation including a National Artificial Intelligence Act and a Data Governance and Protection Act has been signalled but not yet introduced to Parliament.

Framework: National Data Governance & Data Protection Policy 2024 (DICT) — finalised policy awaiting translation into legislation; no comprehensive Data Protection Act yet in force. Existing protections rest on Constitution s.49 (right to privacy) and the Cybercrime Code Act 2016 (No. 35 of 2016).

Papua New Guinea has no comprehensive personal data protection law in force as of mid-2026. The Department of Information and Communications Technology (DICT) finalised a National Data Governance & Data Protection Policy in 2024 and is preparing implementing legislation that would create a Data Protection Commission and GDPR-style obligations; in the meantime privacy is grounded in s.49 of the Constitution, the Cybercrime Code Act 2016, and sectoral rules (telecoms via NICTA, banking via the Bank of PNG).

Framework: National Payments System Act 2013 (No. 10 of 2013); Bank of Papua New Guinea (BPNG) as sole payments regulator; supplemented by Directive on Electronic Funds Transfers 02/2019 and BPNG Regulatory Sandbox (est. 2021)

Papua New Guinea has a foundational payments licensing regime under the National Payments System Act 2013, which empowers the Bank of PNG to license and oversee payment service providers and e-money issuers, and operates two live payment rails (KATS for RTGS and REPS for retail/debit card payments). However, the overall framework is partial: there are no dedicated open banking, BNPL, or instant-credit rules, fintech regulation is largely channelled through a sandbox rather than a standalone licensing track, and the National Payments Strategy was under comprehensive public review in late 2024, with the revised strategy due to the BPNG Board in Q1 2025.

Framework: Migration Act 1978 (Papua New Guinea), administered by the Immigration and Citizenship Authority (ICA) under the Department of Foreign Affairs & Immigration

Papua New Guinea has no dedicated digital nomad or remote-work visa, and no established alternative pathway for independent remote workers. Entry permit categories (visitor, business, employment, permanent residency) are each tied to specific, locally-anchored purposes, employment visas require a Papua New Guinean sponsor/employer, and the business visa covers only short-term commercial activities. Independent freelance or self-employed remote work is not accommodated under any current visa class.

Framework: Cybercrime Code Act 2016 (No. 35 of 2016); National Information and Communications Technology Authority (NICTA); NEC Decision (September 2023) on harmful-website blocking; proposed Social Media Policy 2025

Papua New Guinea's online safety regime is anchored by the Cybercrime Code Act 2016, which criminalises a broad range of online conduct including cyberbullying and electronic defamation (up to 25 years' imprisonment), but no comprehensive dedicated online-safety law analogous to the EU DSA or UK OSA is in force. The government has issued executive-level directives to block harmful and pornographic content, and is consulting on a Social Media Policy 2025 that would mandate biometric age-verification via a national digital-ID for platform access, but formal legislation has not yet passed. In March 2025 Facebook was briefly blocked by police using the Anti-Terrorism Act 2024, without notifying the ICT regulator, drawing parliamentary censure.

Framework: Cybercrime Code Act 2016 (No. 35 of 2016); National Cybersecurity Policy 2021; National Cybersecurity Strategy 2024, administered by DICT and NICTA

Papua New Guinea's primary in-force instrument is the Cybercrime Code Act 2016, which criminalises unauthorised access, data interference, attacks on critical infrastructure, and related offences. A National Cybersecurity Strategy (2024) operationalises capacity-building through a national CERT (PNGCERT) and a Cybersecurity Operations Centre, while a National Data Governance & Data Protection Policy (finalised 2024) introduces breach-notification concepts but remained pending Cabinet enactment as of mid-2026. In October 2024 PNG was formally invited to accede to the Budapest Convention on Cybercrime, with the accession instrument expected to be deposited in late 2025.

Framework: Companies Act 1997 and Investment Promotion Act (Cap. 390), administered by the Investment Promotion Authority (IPA)

Papua New Guinea permits 100% foreign ownership in most sectors, but any entity 50% or more foreign-owned must incorporate under the Companies Act 1997 and then obtain a Foreign Enterprise Certificate from the Investment Promotion Authority (IPA) before commencing operations. The two-stage process takes roughly 2-8 weeks in total. Certain small-scale and cottage-industry sectors are legally reserved for PNG citizens under the Cottage Business Activities List (CBAL) and are entirely closed to foreign enterprises.