Personal Data Protection Act (PDPA)

From 1 January 2027, the core obligations of the Personal Data Protection Act, No. 9 of 2022 apply to every business that collects or uses personal information in Sri Lanka. If your company keeps employee files, customer lists, CCTV footage, WhatsApp order histories or a mailing list, it is processing personal data and the Act applies to you.

Compliance is not a single filing. It is a set of documents, contracts and internal procedures that must already be in place on the day the law starts.

Important Details

• The law is the Personal Data Protection Act, No. 9 of 2022, certified on 19 March 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, certified on 30 October 2025.
• Extraordinary Gazette No. 2498/16 of 22 July 2026 appoints 1 January 2027 as the date on which section 2 (scope), section 3 (the Act prevails over other laws), Part I (processing of personal data) and Part III (controllers and processors) come into operation.
• Part II (data subject rights), Part IV (marketing messages) and Part VII (penalties) are not covered by that order. They will start on a date still to be appointed by a further Gazette Order.
• The regulator is the Data Protection Authority of Sri Lanka (DPA), which has been operating since 2023.
• There is currently no registration or licence to obtain from the DPA, and no government fee.

Who the Act Applies To

Under section 2, the Act applies to processing of personal data where:

• the processing takes place wholly or partly in Sri Lanka; or
• the business doing it is incorporated, established, domiciled or ordinarily resident in Sri Lanka; or
• the business offers goods or services to people in Sri Lanka, or specifically monitors their behaviour, such as by profiling, even if it is based overseas.

The only exclusion is processing by an individual purely for personal, domestic or household purposes. There is no small business exemption. A two-person company with a customer spreadsheet is covered.

Key Terms

Fingerprint attendance machines, staff medical records and student or customer data about under-16s are all special category data. They need a stronger legal basis than ordinary data.

The Lawful Bases for Processing

Under section 5 and Schedule I, every processing activity needs at least one of these bases:

1. Consent of the data subject
2. Contract: necessary to perform a contract with the person, or to take steps they asked for before entering one
3. Legal obligation under Sri Lankan law, such as EPF, ETF and APIT records, or Inland Revenue requirements
4. Emergency threatening someone's life, health or safety
5. Public interest or the exercise of official functions
6. Legitimate interests of the business, unless overridden by the person's interests, especially where the person is a child. Fraud prevention and network security are expressly recognised

Special category data needs one of the stricter conditions in Schedule II as well, such as consent (a parent's or guardian's for a child), employment and social security obligations under law, legal claims, or medical care by a licensed professional.

Consent is not the default. Most routine business processing, such as payroll, invoicing and delivering orders, runs on contract or legal obligation. Where you do rely on consent, Schedule III requires that:

• you can prove the person consented;
• the consent request is clearly separate from other terms;
• the service is not made conditional on consent to processing it does not need; and
• the person is told beforehand that they can withdraw consent at any time.

Your Obligations Under Part I

The Privacy Notice (Schedule V)

When you collect data directly from someone, you must tell them at the time of collection:

• your identity and contact details, and your DPO's contact details if you have one;
• the purposes and the legal basis for each;
• the legitimate interest relied on, where applicable;
• the categories of data collected;
• their right to withdraw consent, where consent is the basis;
• who the data will be shared with;
• any transfer outside Sri Lanka;
• how long it will be kept, or the criteria used to decide;
• their rights and how to exercise them, and their right to complain to the DPA;
• whether providing the data is a legal or contractual requirement, and what happens if they don't; and
• any automated decision-making, including the logic involved and its consequences.

If you received the data from someone else, such as a referral partner or a purchased list, you must also tell the person the source, within one month or at your first communication with them, whichever is earlier.

This applies to employees and job applicants as much as to customers. Most businesses need at least two notices: one for customers and one for staff.

The Data Protection Management Programme (Section 12)

This is the core of compliance and what the DPA will ask to see. It must:

• keep catalogued records showing how you meet sections 5 to 11;
• be designed around the structure, scale, volume and sensitivity of your processing;
• include safeguards based on data protection impact assessments;
• be integrated into your governance structure, with internal oversight;
• include a mechanism to receive complaints, conduct inquiries and identify data breaches;
• be updated through periodic monitoring; and
• enable people to exercise their rights.

In practice this means a record of processing activities (what data, why, which basis, where it is stored, who has access, how long it is kept), a written data protection policy, a retention schedule, a breach response procedure and evidence that staff have been trained.

Your Obligations Under Part III

Data Protection Officer (Section 20)

A Data Protection Officer (DPO) is mandatory where your core activities involve:

• regular and systematic monitoring of people on a prescribed scale;
• processing special category data on a prescribed scale; or
• categories of high-risk processing determined by DPA guidelines.

Typical examples are hospitals and channelling centres, banks and finance companies, insurers, telcos, schools, recruitment agencies, security firms running large CCTV networks, and apps that track users.

The scale has not yet been finalised. Draft regulations published by the DPA for consultation in October 2024 assess it by factors including whether processing involves 25,000 or more data subjects (now or within the next 12 months), whether it is carried out by 20 or more persons, the volume and range of data, and the extent, frequency and duration of monitoring. The draft also expects the DPO to hold a degree in law, business administration, IT, information security, computer science or a related field.

• Since the 2025 amendment, the DPO can be an outsourced third party.
• A group of companies can share a single DPO if they are easily accessible to each entity.
• You must publish the DPO's contact details and communicate them to the DPA.

Even if a DPO is not mandatory for you, someone must be responsible for compliance. Appoint an internal privacy lead.

Processors and Contracts (Sections 21 and 22)

When a third party processes data for you, you must use only processors with adequate safeguards and bind them by a written contract covering:

• the subject matter and duration of the processing;
• the nature and purpose;
• the types of data and categories of people; and
• the obligations of each party.

The processor must act only on your written instructions, bind its staff to confidentiality, allow you to audit it, and delete or return the data when the service ends. A processor that uses data for its own purposes is treated as a controller. A processor is liable for its sub-processors.

List every vendor that touches personal data, such as payroll, accounting, cloud storage, email marketing, CRM, couriers, IT support and call centres, and put a data processing agreement in place with each.

Personal Data Breach Notification (Section 23)

A controller must notify the DPA of a personal data breach. The detailed rules are still in draft. The draft rules published in October 2024 require:

• notification to the DPA, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk, or is likely to result in only a low risk;
• reasons for any delay beyond 72 hours; and
• notification to the affected people where the breach is likely to result in a high risk to them.

A breach includes a lost laptop or phone, an email sent to the wrong list, a hacked account, ransomware, an employee taking customer data, or a misconfigured shared drive. Treat 72 hours as the working standard now, and have a written procedure that sets out who decides and who notifies.

Data Protection Impact Assessment (Sections 24 and 25)

Before starting processing that involves any of the following, you must carry out a data protection impact assessment (DPIA):

• systematic and extensive evaluation of personal or special category data, including profiling;
• systematic monitoring of publicly accessible areas, such as CCTV covering a shop floor, street or car park; or
• other processing the DPA designates by rules.

The DPIA must record the risks and the measures taken to mitigate them, and those measures must be taken before processing starts. A fresh DPIA is needed whenever the methodology, technology or process changes. The DPA can require you to submit it.

Transfers Outside Sri Lanka (Section 26)

The 2025 amendment replaced section 26. A business may transfer personal data abroad only where it ensures the recipient complies with Part I, Part II and sections 20 to 25, using instruments the DPA specifies by directive. Without those, a transfer is permitted only where:

• the person has explicitly consented after being told the risks;
• it is necessary for a contract with the person, or for pre-contract steps they requested;
• it is necessary for legal claims;
• it is necessary for public interest reasons;
• it is necessary in an emergency threatening life, health or safety; or
• the data is only in transit through Sri Lanka.

Google Workspace, Microsoft 365, overseas CRMs, foreign parent companies and offshore payroll are all cross-border transfers. Know where your data is hosted, and record which ground each transfer relies on.

What Comes Later

These parts of the Act are not in operation on 1 January 2027 and await a further Gazette Order. Build for them now.

Data subject rights (Part II). People will have the right to access their data, withdraw consent, object to processing based on public or legitimate interests, have data rectified or erased, and have solely automated decisions reviewed. As amended in 2025, a business must respond within one month, extendable by two months (to three months in total) if the person is told before the first month ends. Requests must be handled free of charge, unless DPA rules allow a fee. A refused person can appeal to the DPA.

Marketing messages (Part IV). SMS, email, phone and WhatsApp promotions will need prior consent under Schedule III, a free opt-out at collection and in every message, and must identify the sender.

Penalties (Part VII). Once in force, the DPA can impose a penalty of up to Rs. 10,000,000 for each non-compliance with a DPA directive, plus an additional penalty of twice the amount for repeat non-compliance. Where the penalty is imposed on a company, every director and officer responsible for management is personally liable unless they prove they had no knowledge or exercised all due care and diligence. An appeal to the Court of Appeal requires the full penalty to be deposited in cash first.

The DPA can already conduct inquiries and issue binding directives under section 35, ordering a business to stop processing, take corrective action or pay compensation to an affected person. From 1 January 2027 it can use these powers for breaches of Part I and Part III. Regulators such as the Central Bank may also take their own action, including suspending licences.

A Readiness Checklist

1. Map your data. List every type of personal data you hold, covering customers, employees, applicants, suppliers' contacts and CCTV, and record where it comes from, where it is stored, who can access it and who it is shared with.
2. Assign a lawful basis to each processing activity, plus a Schedule II condition for special category data.
3. Decide on a DPO. Assess whether one is mandatory. If it is not, appoint an internal privacy lead.
4. Publish privacy notices for customers (website, forms, apps) and for employees and job applicants.
5. Fix consent wherever you rely on it: make it separate, recorded and withdrawable.
6. Set a retention schedule and delete data you no longer need.
7. Sign data processing agreements with every vendor that handles personal data.
8. Review transfers abroad and document the ground for each.
9. Tighten security through access controls, password managers and multi-factor authentication, encryption of laptops and backups, and removing access when staff leave.
10. Write a breach response procedure built around the 72 hour window.
11. Run DPIAs for CCTV, biometric attendance, profiling and any large-scale or sensitive processing.
12. Train staff, especially HR, sales, customer service and anyone with system access, and keep attendance records.
13. Prepare for data subject requests, with a request log and a one month response process, before Part II commences.

Tips by Bizadvisor

• Start with HR. Every company has employee data, much of it special category: medical certificates, fingerprints, and family details for EPF nominations. It is usually the least protected.
• Do not rely on consent for everything. Consent can be withdrawn at any time, and staff cannot freely consent to their employer. Use contract or legal obligation where they genuinely apply.
• WhatsApp groups and personal Gmail accounts used for customer data are a common gap. Move business data into company-controlled systems.
• A privacy policy copied from a foreign website will not meet Schedule V. It must describe what your business actually does.
• Keep evidence. Under section 39, the effectiveness of your Data Protection Management Programme and your cooperation with the DPA are factors in deciding the penalty.
• Watch for the further Gazette Orders on Part II and Part VII, and for the final DPO, breach notification and DPIA rules. Thresholds may change from the drafts.

Useful Links

• Data Protection Authority of Sri Lanka: dpa.gov.lk
• The Act, the 2025 amendment, gazettes and draft rules: dpa.gov.lk downloads
• DPA contact: info@dpa.gov.lk, +94 11 269 7241