Crawls the web, in Papua New Guinea

Cybercrime Code Act 2016 (Papua New Guinea)

• Do not access computer systems without authorization.
• Do not intercept data without authorization.

Copyright and Neighbouring Rights Act 2000 (PNG), No. 21 of 2000, ss. 5, 8, 10, 14, 27-28 · Read the law's page

• Do not reproduce, adapt, or otherwise use a substantial part of a protected literary or artistic work, including text from a published article, beyond what the private-use, quotation, teaching, reprographic, or informatory-purposes exceptions in this Act allow, without the author's or copyright owner's authorization.
• A short quotation of a published work is permitted only where the reproduction is compatible with fair practice, does not exceed the extent justified by the purpose, and is accompanied by an indication of the source and, where it appears in the work, the author's name.
• Reproducing or adapting a computer program without authorization is permitted only when done by the lawful owner of a copy and only to the extent necessary for its use, backup, or error correction; no exception in this Act permits automated bulk reproduction of published works to train a model.
• Do not reproduce a substantial part of a database in digital form under the private-use exception; reproducing a database beyond what another exception allows requires the rightholder's authorization.
• Wilful or grossly negligent infringement carried out for profit-making purposes is a criminal offence carrying up to ten years' imprisonment, a fine of up to K100,000, or both, in addition to civil remedies available to the rightholder.

Cybersecurity Bill 2026 (Papua New Guinea consultation draft), s. 111 · Read the law's page

• This is a bill in public consultation (the fourth draft, opened for comment on 6 August 2026) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind any person or entity that manages a computer system, whether public or private and of any size, not only a CII operator or a financial institution.
• Notify the Authority in the prescribed manner when a computer system you manage suffers a cybersecurity incident, meaning any breach, compromise or disruption affecting the confidentiality, integrity or availability of the system or its data, or an attempted breach that poses a significant risk to the system (ss. 3(1)(o) and 111(1)).
• Make the notification within 24 hours if you are a CII operator or a financial institution, and within 72 hours if you are any other entity (s. 111(1)).
• Include in the notification the information the Authority prescribes (s. 111(2)).

National Data Governance and Data Protection Policy, PNG Department of Information and Communications Technology, 2024 (Cabinet-endorsed; implementing Data Governance and Protection Bill announced 6 August 2026)