Papua New Guinea's Sovereign Data Gamble: The Questions Nobody Is Asking

by PAUL L. KEBAIJA

Papua New Guinea is being sold a bold vision. A sovereign AI data centre, built in partnership between Datec PNG, state-owned telco Telikom, and cloud provider CloudSigma, promises to secure the nation's digital future keeping government data onshore, powering local AI workloads, and positioning PNG as a serious player in the digital economy. It is an ambitious and, on the surface, compelling proposition.
But scratch beneath the surface and serious questions emerge about the expertise behind the initiative, the legal framework underpinning it, and whether PNG's citizens and institutions are being well-served by those driving it forward.
At the centre of this initiative sits Duco Consultancy, a New Zealand-based IT firm founded in 2018 by CEO Chandan Ohri. Ohri is a credentialled professional his background spans accounting, ERP implementations, and management consulting, with prior roles at KPMG, IBM, and BDO New Zealand. He is clearly an experienced operator in enterprise IT. But experience in Microsoft Dynamics and Oracle ERP is a long way from the specialised domain of sovereign data infrastructure, national data governance frameworks, and AI data centre strategy.
A search of Duco Consultancy's publicly available service offerings, partnerships, and project history reveals no meaningful track record in sovereign data a field that demands deep expertise in data residency law, cross-border data flows, security architecture, and national digital policy. Yet here they are, positioned as a key advisory partner for what is being described as a landmark national infrastructure project. The question is not whether Duco Consultancy is a legitimate business it is. The question is whether they are the right organisation to be shaping PNG's digital sovereignty strategy.
That question is made more urgent by the regulatory environment in which this initiative is taking shape. Papua New Guinea currently has no data protection legislation. There is no legal framework governing how citizen data is collected, stored, shared, or monetised. Building a sovereign data centre in a country without data protection laws is a contradiction in terms. Sovereignty implies control but control by whom, governed how, and accountable to what legal standard? Without answers to these questions, the word "sovereign" risks becoming little more than a marketing term.
The choice of infrastructure partners also warrants scrutiny. Telikom, the government-owned telco anchoring this project, has spent years navigating the consequences of a damaging structural breakup that saw it lose significant market share and operational capacity. It is not an obvious foundation for a flagship national technology initiative. CloudSigma, the cloud partner, is a real and operational provider, but it is a niche player not the enterprise-grade, globally resilient infrastructure operator that a project of this ambition demands. When Australia, New Zealand, and comparable nations have built sovereign cloud capability, they have done so with tier-one partners, robust procurement processes, and independent technical oversight.

None of this is to say that PNG should not pursue digital sovereignty. Quite the opposite. The ambition is right. The Pacific region is at a critical inflection point in its digital development, and PNG as the largest Pacific Island nation has both the need and the opportunity to get this right. Data sovereignty, when done properly, can protect citizens, strengthen institutions, and reduce dependence on foreign-controlled infrastructure.
But getting it right requires more than a roadshow. It requires genuine expertise, independent scrutiny, and most critically a legal foundation that gives the concept of sovereignty actual meaning.
PNG deserves a data sovereignty strategy built on competence, transparency, and the rule of law. What is currently on the table raises too many unanswered questions to inspire confidence. The stakes for citizens, for institutions, and for the country's digital future are far too high for good intentions to substitute for rigorous due diligence.