Papua New Guinea Data Governance and Data Protection Bill 2026

What it is

The Data Governance and Data Protection Bill 2026 is a draft law prepared by the Department of Information and Communications Technology (DICT) to give legal force to the National Data Governance and Data Protection Policy 2024. Papua New Guinea has no general data protection statute today, so if the bill is enacted it will be the country’s first.

DICT and NICTA opened public consultation on the bill on 6 August 2026, alongside draft cybersecurity and verifiable credentials bills, and the consultation portal gave 21 August 2026 as the closing date. The ICT Minister said the bills should be expedited for introduction in the September 2026 sitting of Parliament. As at 18 October 2026 the bill has not been enacted. The section numbers below come from the consultation draft published by DICT, marked as the fifth version, and may change before it becomes law.

The draft goes further than most first data protection laws. Alongside the usual rights and duties, it contains a Part on artificial intelligence that applies until Papua New Guinea passes a dedicated AI law.

Who it applies to

The draft applies to the processing of personal data by any person or organisation carrying on an activity in Papua New Guinea, by a controller or processor established there wherever the processing takes place, and in connection with offering goods or services to people in Papua New Guinea. It binds the State.

The AI Part applies to everyone who develops, deploys or operates AI systems in Papua New Guinea, or uses AI to deliver goods or services to people there, wherever the system is hosted or built, as long as its outputs affect people in the country.

What it requires

Impact assessments. Section 53 would require a data protection impact assessment before any processing likely to be high risk. The list expressly includes systematic profiling, biometric data and the deployment of any AI system that processes personal data or materially influences decisions affecting individuals. Where the assessment shows high residual risk, the controller must consult the Authority first.

Automated decisions. Section 69 would bar public bodies from deciding solely by automated means, including by AI, on a person’s legal rights, entitlements, penalties or access to significant public services without meaningful human review. A qualified officer must review and take responsibility for each decision before it is final, and the review must be recorded. Section 70 would give any person a right to request human review of a decision made wholly or substantially by AI that adversely affects them. The reviewer must not have been involved in the original decision, the person must be able to contest it, written reasons are due within 30 days, and the person must be told of the right, with the information available in Tok Pisin.

AI principles and risk tiers. Section 88 would apply seven principles to anyone developing, deploying or operating AI. They are human oversight, transparency, explainability, fairness and non-discrimination, accountability and auditability, safety and security, and data governance. Section 89 would require the Authority to publish a risk-based classification of AI systems. Deployers of high-risk AI, meaning AI that materially influences decisions on rights, entitlements or access to significant public services, or that performs biometric identification, would need an impact assessment, human oversight, auditable records, bias testing and transparency to affected people. Section 90 lists prohibited practices, including harmful subliminal manipulation, exploiting vulnerable groups, government social scoring and deceptive content aimed at electoral or judicial processes.

Disclosure. Section 91 would require any AI system that interacts directly with people, such as a chatbot, to disclose that it is AI.

Breaches and transfers. Controllers would have to notify the Authority of a personal data breach without undue delay and, where feasible, within 72 hours. Section 81 would allow personal data to leave Papua New Guinea only on adequacy, under authorised safeguards such as standard contractual clauses, with express informed consent, or where needed for a contract with the person. Section 82 would require some government and strategically significant data to be hosted in Papua New Guinea or in approved sovereign environments.

For an organisation using AI, that becomes a short list of questions. Which systems affect people, and which are high risk? Has each been assessed before deployment? Where does a person review decisions, and is that review recorded? Can an affected person ask for review and get reasons? And where is the data processed?

Key dates

• 17 May 2024. The ICT Minister announced the National Data Governance and Data Protection Policy 2024 was ready, pending endorsement before going to Cabinet.
• 6 August 2026. DICT and NICTA opened public consultation on the draft bill.
• 21 August 2026. Consultation closing date given on DICT’s consultation portal.
• September 2026. The sitting of Parliament the Minister named as the target for introducing the bill. It had not been enacted as at 18 October 2026.

How it relates to other frameworks

The draft borrows from the GDPR’s rules on automated decisions and its list of prohibited AI practices echoes the EU AI Act. The 2024 policy it implements adopts the OECD AI Principles. For public bodies, it sits alongside the draft PNG Government AI Adoption Framework, which already commits government to no AI-only decisions on rights, benefits or penalties.

Until the bill is law, organisations in Papua New Guinea can use an international framework such as ISO/IEC 42001 or the NIST AI RMF to structure the register, assessments and oversight the draft describes.

A note on this page

This is Aicura’s reading of a draft bill. It is not legal advice, and the bill may change before it is enacted. Read the consultation material published by DICT, and take advice on how the final law applies to your organisation.