Data protection & privacy law in Papua New Guinea (2026)

Legal framework

National Data Governance & Data Protection Policy 2024 (DICT) — finalised policy awaiting translation into legislation; no comprehensive Data Protection Act yet in force. Existing protections rest on Constitution s.49 (right to privacy) and the Cybercrime Code Act 2016 (No. 35 of 2016).

Key points: data & privacy in Papua New Guinea

1. 01No comprehensive PDP law yet

   PNG lacks an enacted, GDPR-style personal data protection statute. The 2024 National Data Governance & Data Protection Policy was finalised by DICT and progressed for ministerial/cabinet endorsement, but it is a policy instrument, not legislation — the implementing Act remains pending.

   ict.gov.pg biometricupdate.com

2. 02Constitutional right to privacy

   Section 49 of the Constitution of the Independent State of Papua New Guinea guarantees a qualified right to privacy of person, property, communications and family life, subject to laws reasonably justifiable in a democratic society.

   parliament.gov.pg constituteproject.org

3. 03Cybercrime Code Act 2016

   Act No. 35 of 2016 criminalises unauthorised access, interception of data, identity theft and computer-related fraud, providing the main statutory protections for the integrity and confidentiality of personal data in the interim.

   parliament.gov.pg ilo.org

4. 04Lead agency / future supervisory authority

   DICT is the policy lead for data governance and protection; the National ICT Authority (NICTA) regulates telecoms-sector data and content. The 2024 policy contemplates a dedicated Data Protection Commission/Office to enforce the future Act, but no independent data-protection authority is yet operational.

   ict.gov.pg nicta.gov.pg

5. 05Sectoral rules in lieu of general law

   Confidentiality and data-handling obligations are dispersed across sectoral instruments — e.g. the National Information and Communications Technology Act 2009 (telecoms), the Banks and Financial Institutions Act 2000 and Bank of PNG prudential standards, and the Cybercrime Code Act 2016 — rather than a unified personal-data regime.

   nicta.gov.pg parliament.gov.pg

6. 06Digital ID & SIM reforms driving privacy build-out

   PNG's Cabinet (NEC) endorsed the National Digital Identity Policy 2025; the SevisPass digital ID and SevisDEx data-exchange platform are scheduled for 2026 rollout, with associated privacy/cyber-security regulations cited by DICT as the trigger for finalising the data-protection legal framework.

   ict.gov.pg ict.gov.pg biometricupdate.com

Sources

1. 1.ict.gov.pg/ndgdpp/
2. 2.ict.gov.pg/wp-content/uploads/2024/policies/National%20DGDP%20Policy%2027-03-24%
3. 3.parliament.gov.pg/uploads/acts/16A_35.pdf
4. 4.parliament.gov.pg/images/misc/PNG-CONSTITUTION.pdf
5. 5.constituteproject.org/constitution/Papua_New_Guinea_2016
6. 6.biometricupdate.com/202405/papua-new-guinea-completes-national-data-protection-and-govern
7. 7.ict.gov.pg/90064/
8. 8.ict.gov.pg/89962/
9. 9.biometricupdate.com/202510/papua-new-guinea-prepares-digital-id-trust-framework-ahead-of-
10. 10.nicta.gov.pg/
11. 11.ilo.org/dyn/natlex/natlex4.detail?p_isn=105171