Sri Lanka's Personal Data Protection Act Takes Effect on 1 January 2027: What Your Business Must Do Now

If your business keeps a list of customers, pays employees, runs CCTV, takes orders on WhatsApp or sends promotional SMS, you are handling personal data. From 1 January 2027, how you collect, use, store and share that data is regulated by law in Sri Lanka.

On 22 July 2026, the government published Extraordinary Gazette No. 2498/16, bringing the core of the Personal Data Protection Act, No. 9 of 2022 (PDPA) into operation on 1 January 2027. The Act has been on the books since 2022, but most of it was never switched on. Its start date was postponed and then reset by the Personal Data Protection (Amendment) Act, No. 22 of 2025. That uncertainty is now over.

That leaves about two months. Here is what you need to know.

What Exactly Comes Into Force on 1 January 2027

The Gazette Order brings four parts of the Act into operation:

• Section 2 defines who the Act applies to.
• Section 3 makes the Act prevail over any inconsistent law on personal data.
• Part I, Processing of Personal Data, sets the rules for collecting and using data: lawful basis, purpose limitation, data minimisation, accuracy, retention, security, transparency and accountability.
• Part III, Controllers and Processors, covers Data Protection Officers, contracts with service providers, breach notification, impact assessments and transfers outside Sri Lanka.

Three parts are not in the order and will start on a later date set by another Gazette Order:

• Part II, the rights of individuals to access, correct and erase their data;
• Part IV, the rules on marketing messages; and
• Part VII, the monetary penalties.

Some businesses read this as "no penalties yet, so no rush". That is a mistake. The obligations bind from 1 January 2027. The Data Protection Authority of Sri Lanka (DPA), which has been operating since 2023, can already conduct inquiries and issue binding directives under section 35, ordering a business to stop processing, put things right or pay compensation to a person who suffered harm. And when the penalties do start, the DPA will look at how long you have been out of compliance.

Does It Apply to Your Business?

Almost certainly. Under section 2, the Act applies if:

• you process personal data wholly or partly in Sri Lanka; or
• your business is incorporated, established or resident in Sri Lanka; or
• you are based overseas but offer goods or services to people in Sri Lanka, or monitor their behaviour.

There is no exemption for small businesses. A sole proprietor with a customer notebook and a listed company with a million customers are subject to the same principles, though what is "appropriate" scales with size and risk.

"Personal data" is defined broadly. It is any information that can identify a person directly or indirectly, including names, NIC numbers, phone numbers, addresses, bank details, location data, IP addresses, photos and CCTV images.

Some data is treated as special category data and needs extra protection. This covers health records, biometric data such as fingerprints and facial images, religious or political beliefs, ethnicity, criminal records and any personal data about a child under 16. If you use a fingerprint attendance machine, keep staff medical certificates or run a school or tuition class, you are processing special category data today.

The Six Ground Rules (Part I)

1. Have a lawful basis for everything

Every use of personal data needs a legal basis from Schedule I: consent, contract, legal obligation, emergency, public interest, or legitimate interests. Many businesses assume they need consent for everything. They don't. Payroll runs on legal obligation (EPF, ETF, APIT). Delivering an order runs on contract. Fraud checks can run on legitimate interests.

Where you do rely on consent, it has to meet Schedule III: you must be able to prove it, it must be clearly separate from your other terms, it cannot be bundled as a condition of a service that doesn't need it, and people must be told they can withdraw it at any time.

2. Use data only for what you collected it for

Data collected for one purpose cannot be reused for an incompatible one (section 6). A phone number collected to deliver a parcel is not automatically available for marketing.

3. Collect only what you need

Personal data must be adequate, relevant and proportionate (section 7). Asking every walk-in customer for a copy of their NIC, or every job applicant for their religion, will be hard to justify.

4. Keep it accurate, and don't keep it forever

Data must be accurate and up to date (section 8), and kept in identifiable form only as long as needed (section 9). You need a retention schedule, and you need to actually delete data when it expires. CVs from rejected applicants three years ago are a typical example.

5. Keep it secure

Section 10 requires appropriate technical and organisational measures, and names encryption, pseudonymisation, anonymisation and access controls. For most SMEs, the real risks are shared passwords, unencrypted laptops, personal Gmail and WhatsApp accounts holding business data, and former employees who still have access.

6. Tell people, and be able to prove it

You must give people a clear privacy notice at the time you collect their data (section 11 and Schedule V). It must cover who you are, why you are collecting the data, the legal basis, who you share it with, whether it goes abroad, how long you keep it, and their rights. This applies to employees as much as customers.

And you must be able to prove all of the above. Section 12 requires every business to run a Data Protection Management Programme: documented records of your processing, internal oversight, a complaints and breach-detection mechanism, and regular reviews. If the DPA comes asking, this is what it will want to see.

The Operational Duties (Part III)

Data Protection Officer

You must appoint a Data Protection Officer (DPO) if your core activities involve large-scale systematic monitoring of people, large-scale processing of special category data, or high-risk processing identified by the DPA. Hospitals, banks, finance companies, insurers, schools, recruitment agencies and security firms are typical examples.

The scale has not been finalised. Draft regulations published for consultation in October 2024 point to factors including 25,000 or more data subjects and 20 or more people carrying out the processing. Since the 2025 amendment, the DPO can be outsourced, and a group of companies can share one. Their contact details must be published and given to the DPA.

Contracts with service providers

Your payroll bureau, accountant, cloud host, CRM, courier and IT support company are all "processors" if they handle personal data for you. Sections 21 and 22 require a written contract with each, setting out what they process, why, for how long, and their obligations, including confidentiality, audits, and deleting or returning the data at the end.

Breach notification

Section 23 requires you to notify the DPA of a personal data breach. Under the draft rules, that means notifying within 72 hours of becoming aware of it, and telling affected individuals where the risk to them is high. A breach is not only a cyberattack. A stolen laptop, an email sent to the wrong group or an ex-employee walking off with the customer list all count.

Impact assessments

Before starting high-risk processing, such as profiling, large-scale evaluation of sensitive data or CCTV monitoring of public areas, section 24 requires a written impact assessment of the risks and the safeguards you will put in place.

Sending data abroad

If your email is on Google Workspace or Microsoft 365, your CRM is hosted overseas, or your parent company abroad receives staff data, you are transferring personal data out of Sri Lanka. Under the new section 26, introduced in 2025, this is allowed only with safeguards specified by the DPA, or on specific grounds such as the person's explicit consent or necessity for a contract with them.

What Comes Next: Rights, Marketing and Penalties

When Part II commences, individuals will be able to ask for a copy of their data, correct it, have it erased, withdraw consent, object to processing, and challenge automated decisions. You will have to respond within one month, extendable to three months, free of charge.

When Part IV commences, promotional SMS, email, calls and WhatsApp blasts will need prior consent and a free opt-out in every message.

When Part VII commences, the DPA can impose penalties of up to Rs. 10 million per non-compliance with its directives, doubled for repeat offenders. Liability extends personally to directors and officers unless they can show they had no knowledge or took all due care. This mirrors the approach in the beneficial ownership rules: responsibility sits with the people running the company.

Systems that can respond to requests within a month take time to build. Start now.

A Practical Plan for the Next Two Months

1. Map your data. Write down every category of personal data you hold, including customers, staff, applicants and CCTV, plus where it lives and who sees it.
2. Assign a lawful basis to each use, and identify any special category data.
3. Decide whether you need a DPO, and if not, name an internal person responsible.
4. Write and publish privacy notices for customers and for employees.
5. Clean up consent for marketing and any other consent-based processing.
6. Set retention periods and delete what you no longer need.
7. Sign data processing agreements with your vendors.
8. Document your transfers abroad.
9. Close the obvious security gaps: multi-factor authentication, encrypted devices, and removing ex-staff access.
10. Put a breach procedure on paper, built around the 72 hour window.
11. Train your staff. Most breaches are human.

The full detail of each obligation, section by section, is in our Personal Data Protection Act handbook guide.