Cybercrime Code Act 2016
Includes provisions for data protection in the context of cybersecurity in Papua New Guinea.
| Jurisdiction | Papua New Guinea |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Cybercrime Code Act 2016 of Papua New Guinea establishes several key requirements for cybersecurity and data protection:
- Criminalization of cybercrimes: The Act defines and criminalizes various cyber offenses, including unauthorized access, illegal interception, and data interference.
- Protection of critical infrastructure: Organizations must implement measures to safeguard critical information infrastructure against cyber threats.
- Reporting obligations: Entities are required to report significant cybersecurity incidents to relevant authorities.
- Data preservation: The Act mandates preservation of computer data for law enforcement purposes when requested.
- International cooperation: Provisions are included for mutual assistance in cybercrime investigations with other countries.
Compliance Challenges
Organizations in Papua New Guinea face several challenges in complying with the Cybercrime Code Act:
- Limited cybersecurity expertise: Many organizations struggle with insufficient skilled personnel to implement robust cybersecurity measures.
- Inadequate infrastructure: Poor internet connectivity and limited technological infrastructure hinder effective implementation of cybersecurity controls.
- Awareness gaps: There is a general lack of cybersecurity awareness among employees and the public, making organizations vulnerable to social engineering attacks.
- Resource constraints: Many organizations, especially smaller ones, struggle with allocating sufficient resources for cybersecurity compliance.
Implementation Best Practices
To effectively implement the Cybercrime Code Act requirements:
- Conduct regular risk assessments: Organizations should perform comprehensive cybersecurity risk assessments to identify vulnerabilities and prioritize mitigation efforts.
- Implement a cybersecurity framework: Adopt a recognized framework like the NIST Cybersecurity Framework to guide your cybersecurity program.
- Establish incident response procedures: Develop and regularly test incident response plans to ensure prompt and effective handling of cybersecurity incidents.
- Provide cybersecurity training: Conduct regular awareness training for employees on cybersecurity best practices and compliance requirements.
- Engage with CERT PNG: Collaborate with the Papua New Guinea Computer Emergency Response Team for guidance and support on cybersecurity issues.
Recent Updates
As of February 2025, there have been no major recent updates to the Cybercrime Code Act 2016. However:
- The government is working on a National Cybersecurity Policy and Strategy to complement the Act, which is currently in progress.
- Papua New Guinea is considering accession to the Budapest Convention on Cybercrime, which may lead to future amendments to align with international standards.
Related Regulations
The Cybercrime Code Act 2016 interacts with several other regulations:
- National Information and Communications Technology Act 2009: Provides the regulatory framework for the ICT sector in Papua New Guinea.
- Evidence Act 1975: Establishes the admissibility of electronic evidence in legal proceedings.
- Mutual Assistance in Criminal Matters Act 2005: Supports international cooperation in cybercrime investigations.
Industry Impact
The Cybercrime Code Act has significant impacts across various industries:
- Financial Services: Banks and financial institutions face increased compliance requirements to protect against cyber fraud and ensure data security.
- Telecommunications: Telecom providers must implement stronger network security measures and cooperate with law enforcement on data preservation requests.
- Government Agencies: Public sector organizations are required to enhance their cybersecurity posture and implement digital government standards.
Sources
- Parliament of Papua New Guinea - Cybercrime Code Act 2016
- PNG National Cyber Security Strategy 2024-2030
- National Information & Communications Technology Authority - Legislative Acts
- Council of Europe - Papua New Guinea Cybercrime Profile
- PNG National Research Institute - Strategies for Combating Cybercrimes in Papua New Guinea
- F1000Research - Cybersecurity in Financial Services Sector
- U.S. Department of Justice - Best Practices for Partnering with Law Enforcement
- NIST Cybersecurity Framework
Recent developments
- — Analysis highlights that recent amendments to Pakistan’s 2016 cybercrime framework risk the **gradual criminalization of journalists and online critics**, as new provisions expand state powers over online speech and platform content moderation, raising significant freedom‑of‑expression concerns.[8] (source)
- — The same analysis reports **industry and civil‑society backlash** to proposals such as a Digital Rights Protection Authority with broad powers to remove social media content, with media‑rights groups warning of increased legal action against journalists and ordinary users.[8] (source)
- — A recent U.S. presidential order on combating cybercrime and fraud directed reviews of **operational and regulatory frameworks against cyber‑enabled crime**, including cross‑border scam operations, reflecting a global move to strengthen and modernize cybercrime codes first introduced around 2016.[3] (source)
- — Committee to Protect Journalists notes that Pakistan’s Senate passed controversial amendments to its cybercrime law, criminalizing the **“intentional” spread of “false news”** with prison terms of up to three years and fines up to 2 million rupees, prompting strong criticism from press‑freedom advocates.[7] (source)
- — Press‑freedom groups argue these 2016‑based cybercrime amendments could be used to **target journalists and political critics**, warning that vague provisions on “false news” enable broad interpretation by authorities and may chill investigative reporting.[7] (source)
- — Government officials in Pakistan indicated plans to **further amend the Prevention of Electronic Crimes Act 2016**, aiming to regulate social media content more tightly and introduce explicit punishment for online defamation of state institutions, citing gaps in the current cybercrime regime.[5] (source)
- — The proposed changes include establishing dedicated **telecommunication appellate tribunals** for swift adjudication of cybercrime cases and expanding liability for online content, which has raised concerns among legal experts about due process and potential overreach.[5] (source)
- — Industry commentators on the Nigerian amendments note that tighter and more explicit cybercrime provisions derived from the 2015–2016 regime are likely to **increase enforcement risk for financial services, telecoms, and online platforms**, driving demand for more robust cybersecurity and legal compliance practices.[4] (source)
- — Nigeria’s President signed the **Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024**, updating and clarifying criteria and enforcement provisions under the country’s main cybercrime statute and signaling a broader regional trend of tightening cybercrime rules originally enacted in the mid‑2010s.[4] (source)
- — Nigeria’s House of Representatives adopted the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Bill 2024 based on the 2015/2016 cybercrime framework, with amendments focused on **clearer definitions of offenses and enhanced preventive measures**, which businesses expect will affect compliance and incident‑response obligations.[4] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates