Papua New Guinea

Papua New Guinea's Cybercrime Code Act 2016 is understood to criminalise unauthorised access to and interception of computer systems and data, but the operative text of its provisions is not reproduced in the available copies of the Act, so its authorization test, penalty tiers, and reach over a public, unauthenticated page are not described here.

The Copyright and Neighbouring Rights Act 2000 is the primary confirmed law reaching automated collection of Papua New Guinea-published content: it excludes from protection any idea, procedure, system, method of operation, concept, principle, or discovery, and permits reproduction without the rightholder's authorization only within named exceptions covering private use, quotation, teaching, reprographic copying by a public institution, reporting current events, and adaptation of a computer program by its lawful owner.

None of these named exceptions is a text-and-data-mining exception, so bulk automated reproduction or ingestion of published works for model training falls outside them and requires the rightholder's authorization.

A substantial part of a database in digital form is expressly excluded from the private-reproduction privilege, and a database attracts copyright only as a compilation where its selection or arrangement is original, so the Act creates no separate sui generis database right of the European kind.

No Papua New Guinea statute or reported decision addresses the legal weight of robots.txt, the enforceability of a browsewrap or clickwrap terms of service against a scraper, or a distinct trespass-to-chattels or hot-news misappropriation doctrine.

Papua New Guinea has no enacted cybersecurity statute; a Cybersecurity Bill 2026 consultation draft and a Bank of Papua New Guinea payments directive are filed as rows of their own.

No enacted statute sets security requirements a software product or connected device must meet before or after being placed on the market, imposes a duty to report an exploited vulnerability or a security incident to an authority, establishes a sector cyber-resilience regime naming a digital service, or imposes a general reasonable-security baseline duty on a private business with no sector gate.

The Cybercrime Code Act 2016 (No. 35 of 2016), read in full, defines critical infrastructure and raises the penalty for offences such as unauthorised access, system interference, data espionage and cyber attack where they are committed against critical infrastructure or against State, military or sensitive data, and Part V makes an ICT Service Provider criminally liable for monitoring users to find illegal activity, facilitating an offence, frustrating a criminal investigation, failing to comply with a court order, or disclosing details of an investigation subject to a confidentiality requirement.

Every one of these binds the person who commits or facilitates an offence against a system, or an ICT Service Provider's conduct toward a criminal investigation; none of them imposes a security-posture duty on an operator or a manufacturer, so the Act's content belongs to this jurisdiction's scraping-topic row rather than adding a security-topic instrument here.

The National Information and Communications Technology Act 2009 (No. 8 of 2009), which establishes the National Information and Communications Technology Authority (NICTA) as the telecommunications licensing and economic regulator, bears on the same question only as follows.

It requires an operator licensee to take reasonable steps to prevent its facility from being used for an offence and to co-operate with NICTA and any agency involved in national security, law enforcement or emergency services, and it empowers NICTA to make rules requiring an operator licensee to implement authorised-interception capability for law enforcement.

Its dangerous conduct concept, conduct that compromises the security or integrity of communications sent via an ICT service or of a network, is a ground on which NICTA may issue a warning, a desist order or seek an injunction against a licensee, and a factor an access provider may rely on to refuse a wholesale access seeker.

None of this is a product-security requirement or a cyber-resilience regime naming a digital service, and the duties that exist bind only a PNG-licensed telecommunications operator, network or content licensee rather than a software or platform provider generally.

No National Cyber Security Centre or other statutory cybersecurity authority with operator-facing duties is confirmed in the primary text consulted here; NICTA itself is a telecommunications regulator rather than a cybersecurity authority.

The Bank's live site returned a bot challenge on every attempt, and the archived list of its banking prudential standards' filenames names capital adequacy, asset classification, limits on loans to related parties and inter-bank placements, external audits, fit-and-proper requirements and general risk-management reporting, with no filename naming cybersecurity or information-technology risk; a media release confirms the Bank disclosed a cyber incident affecting its own systems, which is not a regulatory standard for other institutions.

This lead is accordingly recorded as unconfirmed rather than checked to a conclusion. No Papua New Guinea data-protection or privacy statute is confirmed in the primary text consulted here, so there is no comprehensive privacy regime whose own security-of-processing article would belong to the privacy topic rather than being repeated here. The Department of Information and Communications Technology opened public consultation on the fourth draft of the Cybersecurity Bill 2026 on 6 August 2026.

The draft Cybersecurity Bill 2026 would let the Minister designate critical information infrastructure by notice in the National Gazette and would require a CII operator to implement the minimum cybersecurity controls the Authority prescribes. The draft would also require a CII operator to notify the Authority within 24 hours of becoming aware of a cybersecurity incident affecting a designated CII facility.

The Bank of Papua New Guinea's Directive on Electronic Fund Transfers 02/2019 requires payment service providers to implement a robust security risk management framework to actively identify, assess, reduce and monitor security risk. A contravention of directions made under the National Payments System Act 2013 is an offence under section 30 of that Act.

Papua New Guinea's Classification of Publication (Censorship) Act 1989 (No. 18 of 1989) establishes the Censorship Board and the Office of the Chief Censor to classify publications, films, and advertising matter, and defines a minor as a person under the age of 18 years.

A publication classified as restricted, or a film or advertising matter classified as an “R” film, may not be sold, let on hire, displayed, or delivered to a minor, and a person in charge of a restricted publication area must not permit a minor to enter it; a person who publishes a classified publication or film otherwise than in accordance with these conditions, or who allows a minor to enter a restricted publication area, is guilty of an offence.

The Act does not apply to a publication sponsored by the National Government or a Provincial Government, and its definitions of “publish” and “publication” are confined to selling, hiring, exhibiting, screening, displaying, and advertising physical publications, films, and broadcasting; no provision extends the classification or supply-restriction scheme to an online service, and no separate law addresses social-media minor access, app-store age verification, or an age-appropriate design duty for a service likely to be accessed by children.

The National Information and Communication Technology Act 2009 empowers the Head of State to make content regulations covering advertising content and complaint handling for a licensed content service, but its own section 217(2) provides that the content regulations must not address censorship matters addressed by or under the Classification of Publication (Censorship) Act 1989, so it creates no age-related duty of its own.

The Cybercrime Code Act 2016 criminalises child pornography (s. 18) and child online grooming (s. 19) committed through an electronic system or device, and Part V imposes criminal liability on an ICT Service Provider that monitors or otherwise deals with illegal content it knows about, but each of these duties binds a person or provider generally rather than requiring an operator to verify or gate a user's age.

The Lukautim Pikinini Act 2015 (the Child Protection Act) bars publishing information identifying a child concerned in a protection proceeding (s. 96) and otherwise addresses parental responsibility, child protection orders, and family services, without any provision addressing an internet or online service.

Papua New Guinea has no press-publisher neighbouring right of the European kind, no compelled platform-to-publisher bargaining code, no codified hot-news or misappropriation doctrine, and no statute or reported decision addressing whether linking to or framing a news article is a communication to the public.

Reproducing a headline or short extract of a news article falls to the Copyright and Neighbouring Rights Act 2000's exception for reproduction, broadcasting, or other communication to the public for informatory purposes: the Act permits reproducing in a newspaper or periodical, or broadcasting or otherwise communicating to the public, an article published in a newspaper or periodical on current economic, political, or religious topics, except where the right to authorise that use is expressly reserved on the copies, and separately permits the reproduction and broadcasting or other communication to the public of short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by the purpose.

The Act carries no text-and-data-mining exception, so an aggregator's automated indexing of news content for training or bulk republication must fit within this exception, or the Act's separate quotation exception, or else infringe.