Papua New Guinea seeks feedback on digital ID, data protection laws

Papua New Guinea wants to hear feedback from stakeholders on a set of proposed laws that would overhaul the country’s digital identity system. The three bills together would enshrine the national ID and digital wallet while establishing new regulators, rules and policies to help enable digital government service delivery, an expanded digital economy and age restrictions on social media use.

At the same time, another new credential has been introduced to the nascent ID system to help Papua New Guineans conveniently complete daily activities. SevisWallet users can now request credentials from the Department of Information and Communications Technology (DICT), the Royal Papua New Guinea Constabulary (RPNGC) and National Microfinance Bank (MiBank).

Digital ID services expand

A new RPNGC Police Clearance Verifiable Credential is available for storage in national digital ID wallet SevisWallet, developed by Tech5.

DICT Acting Deputy Secretary and Digital Government Program Director Jessy Sekere referred to the rollout as “another important milestone in Papua New Guinea’s Digital Public Infrastructure (DPI) journey” in a LinkedIn post.

Sekere also says the digital ID system will expand over the next six months with onboarding for Public SevisID for civil servants, mobile driver’s licenses (mDLs), land title, permit and other government credentials. Educational credentials are coming too, along with more public and private sector applications for the credentials and increased support by telecoms for enhanced KYC checks.

PNG’s proposed data protection law

The fifth version of the Data Governance and Data Protection Bill 2026 is intended to provide a legal basis for the National Data Governance and Data Protection Policy 2024.

The proposal specifies “heightened protection” for biometric data. That means it can only be collected or used for designated legal purposes or with explicit consent, with strict limitations on the sale and sharing of the data and requirements for its deletion. Biometric data must be encrypted at the point of capture, and remain encrypted except during processing.

The Bill would also set requirements for data protection impact assessments, notices and fines for compliance breaches. Fines could reach one million Papua New Guinean Kina (roughly US$230,000) for businesses.

It also outlines how PNG’s incoming Digital Identity and Trust Services Framework and the associated regulator will align with the country’s data protection rules.

PNG specifically wants to know stakeholder views on six questions, which reflect common concerns about ensuring fairness, sovereignty and effective enforcement.

In addition to  the data protection legislation’s scope and application, people’s rights and organizations’ duties, the consultation seeks feedback on government data governance and interoperability, sovereign hosting and cross-border data movement, AI and automated decision-making, and how compliance, enforcement and implementation should be handled.

The consultation also asks about the institutional arrangement for PNG’s data protection regime. The phased approach outlined in the legislation starts with NICTA handling the role of data protection authority, before the possible establishment of a National Digital Economy Authority.

PNG’s Department of Information and Communications Technology (DICT) and the National Information and Communications Technology Authority (NICTA) have set up a joint Technical Working Group to review the feedback and further develop the policy.

Age assurance, VC and trust services bills

The proposed Cybersecurity Bill 2026 has 15 parts, including for digital evidence and incident reporting. The most relevant for Biometric Update readers in the short term may be the section on the country’s new age verification rules for social media. Age verification must not require the submission of a government ID document, offering at least one alternative method. The Bill also provides for the appointment of a Child Online Safety Commissioner to oversee the rules.

PNG’s government asks nine questions about the bill, in addition to a similar question about institutional governance as the Data Protection Bill.

The Draft Verifiable Credential & Trust Services Bill 2026, introduced in May, sets the legal foundation for the country’s SevisPass digital ID system, the SevisWallet and use of other, approved digital wallets and the VC ecosystem.

The Trust Services Bill would also establish a Digital Identity Sustainability Fund, which collects fees for verifications and platform participation under certain conditions. The government also plans to establish a regulator for the ecosystem, and for the regulator to set up a Technical Standards and Advisory Committee.

The consultation for the VC and Trust Services Bill contains 47 questions, covering a range of topics from credential acceptance and adoption to the system’s eventual extension to cross-border recognition. Others include “Does the Bill strike the right balance between enabling digital ID and protecting rights?” and “How well does the Bill align with international standards and regional DPI frameworks?” and whether the included data residency requirements are “workable.”

Public consultation on all three bills began on August 6 and closes on August 19, 2026.

Article Topics

age verification  |  cybersecurity  |  data protection  |  digital identity  |  digital sovereignty  |  legislation  |  Papua New Guinea  |  SevisPass  |  verifiable credentials