The framework
Papua New Guinea has no data protection law of general application.
Absent a local rule, the practical constraints come from platform policies and foreign laws with extraterritorial reach.
Marketing and advertising
No comprehensive consent requirement. With no local statute, the practical guardrails are platform policy and any foreign law that can reach the campaign.
Cross-border transfers
With no data protection law, nothing restricts personal data leaving Papua New Guinea, and nothing local protects it once it has. The binding transfer rules for most campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
No penalties exist under a general privacy law, because none exists. Only sectoral, criminal or consumer statutes could reach data misuse in Papua New Guinea, and enforcement of those against marketing practices is rare.