Cybercrime Code Act 2016

· About Cybercrime Code Act 2016

Key Takeaways

  • Papua New Guinea’s Cybercrime Code Act 2016 is the country’s main in-force cybercrime statute; it criminalises unauthorised access, data interference, cyber fraud, cyber harassment, and related offences, and it was certified on 13 December 2016.[2][5][9]
  • The Act applies primarily as a criminal law, so obligations fall on individuals and corporate bodies whose conduct fits the offence definitions, including service providers in some circumstances under Part V-style liability provisions described in current legal analyses.[5][9]
  • The statute has been publicly identified by the Department of ICT in 2026 as a law due for amendment, with draft reforms aimed at AI deepfakes, voice cloning, digital impersonation, and related online harms.[1][13][14]
  • No publicly confirmed 2025–2026 enacted amendment to the Cybercrime Code Act 2016 was identified in the available materials; the 2026 materials describe consultation and intended introduction, not a completed amendment process.[1][10][13][14]
  • Penalties under the Act are severe and vary by offence, including fines up to PGK 100,000 and imprisonment up to 30 years for some aggravated offences, with corporate penalties also expressly provided for certain crimes.[4][5][9]
  • The Act does not function as a general data protection law; current 2026 materials instead point to separate proposed digital legislation and broader cybersecurity reform packages that may interact with it.[1][10][12]

What It Is

The Cybercrime Code Act 2016 is Papua New Guinea’s principal cybercrime criminal statute, certified on 13 December 2016 and published by the National Information and Communications Technology Authority.[2][7] It creates offences covering unauthorised access, data and system interference, cyber-related fraud and harassment, and certain offences against critical infrastructure and protected data, as reflected in current regulator and legal-reference summaries.[5][9]

The enforcement body is the Papua New Guinea state, through the criminal justice system, with the National Information and Communications Technology Authority publishing the Act and the Department of ICT leading current reform work.[1][2][7] The Act’s current status in 2026 is in force, while reform remains proposed rather than enacted.[1][9][13][14]

The exact dates visible in the public record are limited. The Act was certified on 13 December 2016 and published the same day on the NICTA site.[2][7] Public 2026 statements say amendments are being drafted and intended for parliamentary introduction, but the materials reviewed do not show a passed amendment or an enacted replacement date.[1][13][14]

Who Must Comply

The Act applies to any person who commits a defined cyber offence within Papua New Guinea’s jurisdiction, including individuals and corporate bodies where the offence provisions expressly extend liability to companies.[4][5][9] Current summaries also describe offences reaching conduct involving protected or non-public electronic systems, data, and critical infrastructure.[4][5]

Its practical reach is broad because cyber offences can be committed remotely, and the law is framed around the prohibited conduct rather than the offender’s nationality.[5][9] That means foreign actors, offshore providers, and cross-border users can be exposed if their conduct affects Papua New Guinea systems, data, or users and is captured by the offence definitions.[5][9]

There is no indication in the reviewed sources of a general SME exemption, nonprofit exemption, or sector-wide carve-out from the criminal offences.[2][5][9] Instead, any exemption would have to arise from the text of a particular offence, prosecutorial discretion, or another law, none of which is described in the available materials as a blanket exclusion.[2][5]

Core Requirements

  1. Do not access systems without authorisation. The Act criminalises intentional unauthorised access to protected or non-public electronic systems, devices, or data, with imprisonment and fines available as penalties.[4][5]
  1. Do not interfere with data or systems. Current summaries of the Act describe offences for data interference, system interference, and conduct that disrupts availability or integrity, especially where protected systems or critical infrastructure are involved.[5][9]
  1. Do not use systems for cyber fraud or espionage. The law covers cyber-related fraud, identity theft, and data espionage-type conduct, with higher penalties where sensitive, state, military, or critical infrastructure systems are targeted.[5][9]
  1. Do not publish or transmit unlawful harmful content where the Act captures it. Public summaries of the statute describe offences relating to defamatory publication, harassment, pornography, and other harmful online conduct, although these provisions have been criticised for chilling lawful expression.[4][11][12]
  1. Do not obstruct investigations or disobey court orders if you are a service provider. Legal analyses of the Act describe liability for ICT service providers that monitor users for illegal activity, facilitate offences, frustrate investigations, fail to comply with court orders, or breach confidentiality requirements tied to investigations.[6][9]
  1. Treat critical infrastructure and sensitive data as aggravated-risk categories. The Act imposes substantially harsher sanctions where offences involve critical infrastructure or designated sensitive state, military, or personal data categories.[5][9]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Act certified | 13 December 2016 | The Cybercrime Code Act 2016 entered the public record as certified law.[2][7] | | Current status confirmed in regulator materials | 2026 | The Act remains the principal in-force cybercrime law, while reform is still under consultation or drafting.[1][2][9][13] | | Proposed reform consultation | 6 August 2026 | Drafting instructions and consultation materials for amendments were made available for public input.[1] |

The maximum penalties reported in current public summaries include imprisonment up to 30 years and fines up to PGK 100,000 for some aggravated offences, with corporate fines reported up to PGK 500,000 for at least one offence category in a public news summary of the Act.[4][5] Other offences carry lower ceilings such as up to 5, 7, 10, or 15 years’ imprisonment and fines from PGK 7,000 to PGK 100,000, depending on the offence.[4][5]

Other sanctions can include disqualification from use of ICT devices or systems for a defined period in harassment-type cases, and the criminal liability of corporations where the offence provision so provides.[4] Because the reviewed sources are summaries rather than the full annotated statute text, penalty figures should be checked against the official Act text before relying on them for enforcement action.[2][4][5]

How to Comply

  1. Map your data and systems. Identify which systems, user accounts, and datasets are exposed to Papua New Guinea operations, users, or infrastructure, and classify any critical or sensitive assets first.
  1. Build a cybercrime response control set. Use ISO 27001 to document access controls, logging, incident response, supplier security, and evidence preservation, because those controls align with the Act’s focus on unauthorised access, interference, and investigation support.
  1. Harden detection and response. Use NIST CSF 2.0 to structure identify, protect, detect, respond, and recover activities, with particular emphasis on logging, anomaly detection, and legal hold processes for cyber incidents.
  1. Cover AI-driven abuse scenarios. If your products, channels, or brand use generative AI, add controls from ISO 42001 for model governance, content controls, human review, and misuse detection, which matches the 2026 reform focus on deepfakes, voice cloning, and impersonation.[1][13][14]
  1. Review service-provider obligations. If you host, transmit, or manage user content or traffic, establish procedures for lawful preservation, court-order response, investigation cooperation, and non-interference with evidence.
  1. Train staff on prohibited conduct. Give operational teams clear rules on authorised access, password use, testing boundaries, offensive security, fraud indicators, and escalation paths for suspicious content or account abuse.
  1. Test with incident simulations. Run tabletop exercises covering unauthorised access, data tampering, impersonation, and law-enforcement requests so legal, security, and communications teams can coordinate under pressure.

Related Regulations

Cybersecurity Bill 2026 (proposed): The Department of ICT’s 2026 consultation package indicates a broader cybersecurity law is being developed, so duplication and sequencing with the Cybercrime Code Act are active issues rather than settled law.[10]

National Information and Communications Technology Act 2009: The ICT Ministry has linked reform of the cybercrime law to parallel changes in the NICT Act, suggesting overlapping regulatory architecture for telecoms and digital governance.[1][10]

Evidence Bill 1975: The proposed cybersecurity consultation materials explicitly mention the Evidence Bill 1975, which matters because cybercrime enforcement often depends on admissibility, preservation, and chain-of-custody rules.[10]

Data Governance and Data Protection Bill 2026: Consultation materials reference a proposed data governance and data protection framework, which may overlap with cybercrime provisions where data misuse, breach response, and privacy incidents intersect.[10]

Budapest Convention on Cybercrime: PNG’s 2026 reform messaging says the review supports alignment with the Budapest Convention and the UN Cybercrime Convention, so international cooperation and offence harmonisation may become more important.[13][14]

FAQ

Does the Cybercrime Code Act 2016 apply to companies outside Papua New Guinea?

Yes, if conduct attributable to the company fits an offence in Papua New Guinea’s cybercrime law and affects systems, data, or users within its scope.[5][9] The public summaries do not describe a nationality-based exemption, and cyber offences are typically framed around conduct and impact rather than incorporation alone.[5][9]

Is the Cybercrime Code Act 2016 a data protection law?

No, it is primarily a criminal cybercrime statute, not a general privacy or data protection regime.[2][9] Some materials describe it as including data-related offences in a cybersecurity context, but that is different from setting comprehensive rights, lawful bases, or controller obligations.[1][10][12]

Have the 2025–2026 amendments already passed?

No enacted amendment was identified in the reviewed 2026 materials.[1][10][13][14] What is publicly confirmed is consultation and drafting for amendments that may address deepfakes, voice cloning, and digital impersonation, with intended parliamentary introduction still described as forthcoming.[1][13][14]

What are the biggest penalties under the Act?

Public summaries report penalties as high as 30 years’ imprisonment and fines up to PGK 100,000 for some aggravated offences, with some corporate fines reported up to PGK 500,000.[4][5] Lower offence bands also exist, so penalty exposure depends on the exact charge.[4][5]

Does the Act target online speech?

The Act has been used in ways that critics say can criminalise legitimate online expression, and public human-rights material urges amendment of criminal defamation provisions.[3][12] At the same time, the current reform agenda is framed by government as a response to harmful AI misuse and online abuse, so speech-related provisions remain politically and legally contested.[1][8][13]

Sources

Put it into practice

More compliance guides