Papua New GuineaCybersecurity Bill 2026, Mandatory Incident Reporting by Any Entity
Cybersecurity Bill 2026 (Papua New Guinea consultation draft), s. 111
A published draft that has not reached a legislature, dated , as of .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
Where it has got to
The text described here is Proposed Cybersecurity Bill 2026, fourth draft for external consultation, published .
Locally, this stage is fourth draft of the Cybersecurity Bill 2026 released for external consultation by the Department of Information and Communications Technology.
The stage above is recorded at www.ict.gov.pg.
The Department of Information and Communications Technology lists the consultation as open from and closing on ; the bill carries no number, and its certification date is blank.
What it requires
- This is a bill in public consultation (the fourth draft, opened for comment on ) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind any person or entity that manages a computer system, whether public or private and of any size, not only a CII operator or a financial institution.
- Notify the Authority in the prescribed manner when a computer system you manage suffers a cybersecurity incident, meaning any breach, compromise or disruption affecting the confidentiality, integrity or availability of the system or its data, or an attempted breach that poses a significant risk to the system (ss. 3(1)(o) and 111(1)).
- Make the notification within 24 hours if you are a CII operator or a financial institution, and within 72 hours if you are any other entity (s. 111(1)).
- Include in the notification the information the Authority prescribes (s. 111(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
A person or entity required to report a cybersecurity incident under the draft who fails to do so within the prescribed time is liable to a fine of up to K50,000 (s. 100).
- Rule
- Fixed only
- As of
- Currency
- PGK
- Fixed cap
- 50,000
Who enforces it
Enforcement body
The National Information and Communications Technology Authority, which the draft deems the National Cybersecurity Authority until a separate National Cybersecurity Authority is established.
What this law does
Section 111 of the Cybersecurity Bill 2026 would require a person or entity that manages a computer system that suffers a cybersecurity incident to notify the Authority in the prescribed manner within 24 hours if it is a CII operator or financial institution, or within 72 hours if it is any other entity.
Section 3 of the draft would define a cybersecurity incident as any breach, compromise or disruption affecting the confidentiality, integrity or availability of a computer system or the data it holds, or any attempted breach that poses a significant risk to a computer system. Section 100 of the draft would make a failure to report a cybersecurity incident within the prescribed time an offence carrying a fine of up to K50,000.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.