AI and Papua New Guinea's data protection bill

Papua New Guinea is writing its AI rules into its first data protection law. The draft Data Governance and Data Protection Bill 2026 would set duties for anyone using AI that affects people in the country, and the draft Government AI Adoption Framework sets the rules for public bodies. Neither is final as at 18 October 2026. Both point to the same work, and organisations that start it now will have little to change when the law arrives. The detail of each instrument is on its framework page, the bill and the Government AI Adoption Framework.

Where PNG’s AI rules stand

Three documents matter, and all three are drafts.

• The Data Governance and Data Protection Bill 2026. Released for public consultation by DICT and NICTA on 6 August 2026, with the consultation portal closing on 21 August. It gives legal force to the National Data Governance and Data Protection Policy 2024 and includes a Part on AI that applies until a dedicated AI law is passed.
• The Government AI Adoption Framework, DG × DPI ^ AI. Published for consultation on 27 February 2026. It governs how public bodies adopt AI.
• The National Sovereign Digital Transformation and AI Strategy. Announced on 22 March 2026. It proposes a National Artificial Intelligence Act and a National Digital Economy Authority with oversight of AI.

Today the binding rules on government ICT come from the Digital Government Act 2022. DICT says sections 14 and 15 of that Act require prior DICT approval and a Certificate of Compliance for public body ICT designs, procurement and investment before funding, procurement or implementation proceeds. AI projects in government go through that process.

What the bill would ask of organisations using AI

The section numbers here come from the consultation draft DICT published and may change.

Assess before you deploy. Section 53 would require a data protection impact assessment before deploying any AI system that processes personal data or materially influences decisions affecting individuals. Where residual risk stays high, you would consult the Authority before going live.

Know which systems are high risk. Section 89 defines high-risk AI as AI that materially influences a decision on a person’s legal rights, entitlements or access to significant public services, or performs biometric identification. Deployers of high-risk AI would need human oversight, auditable records of the system’s operation, bias testing before deployment and periodically after, and plain-language transparency to the people affected.

Offer human review. Section 70 would let any person ask for human review of a decision made wholly or substantially by AI that adversely affects their rights, benefits, entitlements or access to significant public services. The reviewer must not have been involved in the original decision, the person must be able to contest it, and written reasons are due within 30 days. People must be told of the right when the decision is communicated, with the information available in Tok Pisin.

Tell people when they are talking to AI. Section 91 would require chatbots and virtual assistants to disclose that they are AI.

Report breaches and watch transfers. Personal data breaches would go to the Authority within 72 hours where feasible. Section 81 would let personal data leave Papua New Guinea only to a jurisdiction found adequate, under authorised safeguards such as standard contractual clauses, with express informed consent, or where needed to perform a contract with the person.

What public bodies already face

The Government AI Adoption Framework commits government to no AI-only decisions on legal rights, benefits, penalties or enforcement, no secret citizen scoring, no untested AI in high-impact services, and no unapproved external AI systems directly controlling core government decisions. It promises internal registers of AI systems, risk-based assessment before deployment, and a way for people to ask for an explanation, request human review and complain.

The bill would turn the first of those into law. Section 69 would bar public bodies from deciding solely by automated means on rights, entitlements, penalties or access to significant public services without meaningful human review, with a qualified officer taking responsibility for each decision and a record of the review kept for audit. A decision made in breach would be voidable by the affected person. Section 82 would require government data classified restricted or confidential, and data from nationally significant digital public infrastructure, to be stored and processed in Papua New Guinea or in sovereign environments the Minister approves.

How to prepare now

Build the register. Every duty above starts from knowing which AI you run. List every AI system and agent, including AI features inside software you already use and tools staff adopted on their own, with an owner and what each one decides or influences. The AI system register guide covers what each entry needs.

Mark the systems that affect people. Flag every system that touches personal data or influences decisions about people. Those are the ones the bill would require you to assess, and the ones that may be high risk.

Assess and record oversight. Run an impact assessment on each flagged system that sets out who is affected, what could go wrong and how you control it. Record where a person reviews the system’s decisions and how a review request would be handled. The impact assessment guide and the human oversight guide cover both.

Map where data goes. For each system, note where personal data is processed. If the transfer rules pass as drafted, every overseas service will need a lawful route.

Where Aicura fits

Aicura’s AI Register holds every AI system and agent with its owners, status and version history, and records whether a system affects individuals and its level of human oversight. Discovery surfaces AI in use that is not yet on the register. Assessments set out who each system affects and how risks are controlled, and the policies, guardrails, monitoring and incident records sit on the same system records. That supports the work the draft bill and framework describe. It is guidance for your own judgement, not a ruling on how PNG law applies to you.

Aicura is hosted on AWS in Sydney, Australia, for every customer, with AI inference through Amazon Bedrock in Australia. Personal data you put into Aicura therefore leaves Papua New Guinea, and Aicura’s data processing agreement covers how it is handled. If the bill passes with the transfer rules as drafted, check which section 81 route your use relies on.

A note on this page

This page reads draft instruments that may change before they take effect. It is not legal advice. Read the consultation material DICT publishes, and take advice on how the final law applies to your organisation.