VPNs with servers in Papua New Guinea

On sworn evidence, a court may order a provider whose service is available in the country to record data or communications. It may also order production of information about the persons who subscribe to or use a provider’s services, and collection of traffic data for a specified communication. Police may require data to be preserved for 14 days, extendable once by a Magistrate for another 14.

The Act fixes no standing retention period, and whether it reaches a VPN operator is not established. A fourth consultation draft of a Cybersecurity Act 2026, on the Department of ICT’s website with a file date of 5 August 2026, would require a registered platform or ICT service provider to retain prescribed subscriber registration, traffic and user identification data for no more than 24 months (draft s. 106). It is a draft, not law.

In March 2025 police directed mobile operators to cut access to Facebook on their networks, invoking section 16 of the Counter Terrorism Act 2024.

According to the Department of Information and Communications Technology’s publication of the remarks of the chair of Parliament’s Committee on Communications, the Committee found that this was a temporary restriction by direction to operators, that no regulation or standard operating procedure existed under that Act, and that the head of the regulator, NICTA, and the ICT Minister were unaware of it. The chair said the Committee supports no form of social media ban.

Using an electronic system to publish defamatory material is a crime. For a natural person the penalty is a fine of up to K25,000 or imprisonment of up to 15 years, rising to K50,000 or 25 years where the publisher knows the material is false. Truth, public benefit, fair comment and good faith are defences.

The Act also creates offences of cyber bullying of a child and of cyber harassment. Subscriber details are sought through the court production order. In August 2024 the Supreme Court, on a reference from a criminal defamation prosecution, held the Act’s criminal defamation provision a permissible restriction on freedom of expression.

The Act declares that where it limits freedom from arbitrary search, freedom of expression and privacy (Constitution ss. 44, 46 and 49), it does so as necessary for public safety, public order and public welfare and as reasonably justifiable in a democratic society. Interception, traffic-data collection and production of subscriber information each require a court order. The order of the rows is the security score, and a server’s location is not a recommendation.