Cybersecurity law & regulation in Papua New Guinea (2026)

Legal framework

Cybercrime Code Act 2016 (No. 35 of 2016); National Cybersecurity Policy 2021; National Cybersecurity Strategy 2024, administered by DICT and NICTA

Key points: cybersecurity in Papua New Guinea

1. 01Cybercrime Code Act 2016

   The foundational statute (No. 35 of 2016, certified 13 December 2016) criminalises unauthorised system access, data interception, hacking, cyberbullying, identity theft, and computer-related fraud. It includes specific provisions protecting critical infrastructure, national power grid, water supply, LNG plant, air services, and health systems, and amended the Evidence Act to admit electronic evidence.

   parliament.gov.pg parliament.gov.pg nicta.gov.pg

2. 02National Cybersecurity Strategy 2024

   Administered by the Department of Information and Communications Technology (DICT), the strategy prioritises protecting critical infrastructure, developing PNGCERT (the national CERT), building digital forensics capabilities, enhancing incident-response reporting, and deepening partnerships with Australia, India, South Korea, and Israel. The National Cyber Security Centre was launched alongside earlier policy work.

   ict.gov.pg png.embassy.gov.au pacson.org

3. 03Budapest Convention accession

   On 9 October 2024 the Council of Europe's Committee of Ministers formally invited PNG to accede to the Convention on Cybercrime (Budapest Convention). DICT announced PNG's intent to deposit the accession instrument in late 2025, aligning domestic investigative and mutual-assistance frameworks with the treaty.

   coe.int ict.gov.pg

4. 04Data Governance & Data Protection Policy 2024

   DICT finalised the National Data Governance & Data Protection Policy (v5.2, March 2024). It applies to all data controllers and processors in the public and private sectors and introduces breach-notification obligations and administrative penalties up to PGK 500,000 for serious violations. As of mid-2026 the policy was still awaiting Cabinet endorsement before progression to statute law, meaning no binding breach-notification law is yet in force.

   ict.gov.pg ict.gov.pg biometricupdate.com

5. 05Regulatory authorities

   NICTA (National Information & Communications Technology Authority) is the statutory converged ICT regulator and licensing authority; DICT sets whole-of-government digital and cybersecurity policy. PNGCERT coordinates national incident response, and PNG participates in the Pacific Cyber Security Operational Network (PaCSON) for regional threat-sharing.

   nicta.gov.pg pacson.org

6. 06ITU GCI 2024 ranking

   In the ITU's 2024 Global Cybersecurity Index, PNG advanced from Tier 5 (2020) to Tier 3, doubling its score from 26.34 to over 58, driven by improvements in legal measures, technical measures, and organisational frameworks, placing it second in the Pacific after Vanuatu.

   info.gov.pg itu.int

Sources

1. 1.parliament.gov.pg/index.php/bills-and-legislation/view/cybercrime-code-act-2016
2. 2.parliament.gov.pg/uploads/acts/16A_35.pdf
3. 3.nicta.gov.pg/regulatory/internet/cybercrime-cybersecurity/
4. 4.ict.gov.pg/ncss/
5. 5.ict.gov.pg/ndgdpp/
6. 6.ict.gov.pg/png-joins-the-budapest-convention-on-cybercrime/
7. 7.coe.int/en/web/cybercrime/-/kenya-malawi-and-papua-new-guinea-invited-to-acce
8. 8.png.embassy.gov.au/pmsb/784.html
9. 9.pacson.org/members/papua-new-guinea
10. 10.info.gov.pg/papua-new-guinea-makes-major-leap-in-global-cybersecurity-rankings/
11. 11.biometricupdate.com/202405/papua-new-guinea-completes-national-data-protection-and-govern
12. 12.itu.int/en/ITU-D/Cybersecurity/Documents/GCIv5/2401416_1b_Global-Cybersecurit
13. 13.ict.gov.pg/wp-content/uploads/2024/policies/National%20DGDP%20Policy%2027-03-24%