Papua New GuineaCybersecurity Bill 2026, Incident Reporting by CII Operators and Financial Institutions
Cybersecurity Bill 2026 (Papua New Guinea consultation draft), ss. 35 and 41(b)
A published draft that has not reached a legislature, dated , as of .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
Where it has got to
The text described here is Proposed Cybersecurity Bill 2026, fourth draft for external consultation, published .
Locally, this stage is fourth draft of the Cybersecurity Bill 2026 released for external consultation by the Department of Information and Communications Technology.
The stage above is recorded at www.ict.gov.pg.
The Department of Information and Communications Technology lists the consultation as open from and closing on ; the bill carries no number, and its certification date is blank.
What it requires
- This is a bill in public consultation (the fourth draft, opened for comment on ) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind the same CII operators and financial institutions as the draft's critical information infrastructure and financial systems provisions (ss. 31, 35 and 40) (reached by declaring that you operate an essential service, provide financial services, provide telecom services or handle health records).
- Notify the Authority within 24 hours of becoming aware of a cybersecurity incident affecting a designated CII facility or system, stating what happened, when it was discovered, which facility or system is affected, its likely impact and the measures taken or proposed to mitigate it (s. 35(1) and (2)).
- Provide a full incident report to the Authority within 7 days of the incident (s. 35(3)).
- If you are a financial institution, report a cybersecurity incident affecting your systems to both the Authority and the Bank of Papua New Guinea within 24 hours of detection (s. 41(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
A person or entity required to report a cybersecurity incident under the draft who fails to do so within the prescribed time is liable to a fine of up to K50,000 (s. 100).
- Rule
- Fixed only
- As of
- Currency
- PGK
- Fixed cap
- 50,000
Who enforces it
Enforcement body
The National Information and Communications Technology Authority, which the draft deems the National Cybersecurity Authority until a separate National Cybersecurity Authority is established.
What this law does
Section 35 of the Cybersecurity Bill 2026 would require a CII operator that becomes aware of a cybersecurity incident affecting a designated CII facility or system to notify the Authority within 24 hours of becoming aware. Section 35(2) of the draft would require the notification to describe the incident, give the date and time it was discovered, name the CII facility or system affected, state its likely impact and state the measures taken or proposed to mitigate it.
Section 35(3) of the draft would require a CII operator to provide a full incident report to the Authority within 7 days of the incident. Section 41(b) of the draft would require a financial institution to report a cybersecurity incident affecting its systems to both the Authority and the Bank of Papua New Guinea within 24 hours of detection. Section 100 of the draft would make a failure to report a cybersecurity incident within the prescribed time an offence carrying a fine of up to K50,000.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.