Encryption Law by Country
Where strong encryption is a right, restricted, or compelled. National law and policy, mirrored per country.
Source: Global Partners Digital, World Map of Encryption, updated 2026-07-02. Full data at www.gp-digital.org/world-map-of-encryption
Encryption Law by Country (196)
General right to encryption
No known legislation or policies.
Mandatory minimum or maximum encryption strength
No known legislation or policies.
Licensing/registration requirements
No known legislation or policies.
Import/export controls
No known legislation or policies.
Other restrictions
No known legislation or policies.
Obligations on individuals to assist authorities
Section 33 of the Cybercrime Code Act 2016 provides that a police officer, where they suspect on “reasonable grounds that a thing may provide evidence of a commission of an offence”, and in execution of a warrant, can direct a person to operate an electronic system or device in order to access that data (and subsequently seize or copy that data). Section 34 of the Act further provides that upon production of a warrant, a police officer may also require a person assist or enable the officer to access or obtain/copy the data (in a format that can be read) even if that person is not a suspect of an offence, but is in possession or control of a device or data that is “reasonably required for the purposes of an investigation or proceeding”. A copy of the Cybercrime Code Act 2016 can be found here .
Obligations on providers to assist authorities
Section 39 of the Cybercrime Code Act 2016 states that a court can, where satisfied on the basis of sufficient grounds that data or communications are reasonably required for an investigation or proceeding, order an ICT service provider to collect and record (or authorise or assist police to collect and record) data or communications transmitted by means of an electronic system. Section 40 of the Act similarly allows a court to order a person in control of traffic data associated with a specified communication to collect and record such data (or enable and assist police to collect and record it). Section 44(1)(d) of the Act provides that an ICT Service Provider that does not comply with such a court order is guilty of a crime resulting in a fine not exceeding K1,000,000 (if a body corporate) or a fine not exceeding K100,000 and/or imprisonment for a term not exceeding 25 years (if a natural person). A copy of the Cybercrime Code Act 2016 can be found here .
Assessment Text Area
In Papua New Guinea, a court can order an ICT service provider to collect and record or authorise or assist police to collect and record electronic data or communications. An ICT Service Provider that does not comply with such a court order is guilty of an offence punishable by imprisonment and/fine. Police officer in possession of a warrant can direct a person to operate an electronic system or device in order to access encrypted data data (and subsequently seize or copy that data).
Murphy's Law