Under the Personal Data Protection Act No. 9 of 2022, businesses must be ready to identify a lawful basis for their processing, answer data-subject requests within one month, and satisfy the rules on sending data abroad. Penalties can reach LKR 10 million for each non-compliance. Part I and Part III come into operation on 1 January 2027.
Sri Lanka now has a law telling organisations how they may collect and use personal data. The Act was the first comprehensive data protection statute in South Asia, and it borrows heavily from the European Union's General Data Protection Regulation, or GDPR. If your organisation handles personal data, whether it is based in Sri Lanka or simply deals with people who are, the Act applies to you.
What the Act does and when it applies
Parliament passed the Act on 19 March 2022, but it does not all switch on at once. It comes into force in stages. The Data Protection Authority of Sri Lanka, the regulator that runs the system, was set up in 2023. The parts that actually bite, meaning the rules on processing personal data, the rights of data subjects, the duties of controllers and processors, and the penalties, take effect on a date the Minister appoints by Gazette. A later amendment, the Personal Data Protection (Amendment) Act No. 22 of 2025, adjusted the scheme again, and the waiting has now been given a date: by Gazette Extraordinary No. 2498/16 of 22 July 2026, sections 2 and 3, the processing obligations in Part I and the controller and processor duties in Part III take effect on 1 January 2027. The data subject rights in Part II and the penalty regime await a further Order. The framework is settled, and the preparation window now has an end printed on it.
Who the Act covers
The Act reaches well beyond Sri Lankan companies. It applies:
- Within Sri Lanka: where the processing of personal data takes place wholly or partly in Sri Lanka, or is carried out by a person or entity in Sri Lanka.
- Outside Sri Lanka: to entities abroad that offer goods or services to individuals in Sri Lanka, or that monitor the behaviour of individuals in Sri Lanka.
This extraterritorial reach mirrors the GDPR, and it means an overseas business with Sri Lankan customers or users can fall within the Act even without a local office.
What counts as personal data
Personal data is any information by which an individual can be identified, directly or indirectly, such as a name, an identification number, financial or location data, or an online identifier.
The Act gives extra protection to special categories of personal data, which include information revealing racial or ethnic origin, political opinions, religious beliefs, genetic and biometric data, health data, sex life or sexual orientation, information about criminal offences, and data relating to children.
The rights of individuals
The Act gives data subjects a set of enforceable rights over their personal data:
- Access: to confirm whether their data is being processed and obtain a copy.
- Withdraw consent: where the processing is based on consent.
- Object: to processing carried out on legitimate-interest or public-interest grounds.
- Rectification: to have inaccurate or incomplete data corrected or completed.
- Restriction: to limit processing in defined circumstances.
- Review of automated decisions: where a decision taken solely by automated means has a significant and irreversible effect.
- Erasure: to have their data deleted under specified conditions.
The time limit for answering was rewritten by the 2025 amendment, and older summaries, including an earlier version of this article, state the original figure. Section 17(1) as enacted in 2022 gave the controller twenty-one working days. Section 4 of the Personal Data Protection (Amendment) Act No. 22 of 2025 replaced it: the controller must now inform the data subject in writing, without undue delay and within one month of receiving a request under section 13, 14, 15, 16 or 18, whether the request was granted or refused, and if refused, the reasons, unless a written law prohibits disclosing them. A new section 17(1A) allows the period to be extended, for reasons assigned, by a further two months, so that the whole cannot exceed three months from receipt, and section 17(1B) requires the data subject to be told of the extension before the first month runs out. Section 17(1C) requires the controller to tell the data subject of the right of appeal to the Authority against a refusal. Section 17(2) sets out the grounds on which a controller may refuse, and section 17(3) requires the reasons for any refusal to be recorded and produced to the Authority on request. Under the substituted section 17(6), requests are dealt with free of charge unless the Authority by rules allows a fee.
The amendment also rewrote section 19. A data subject refused access, withdrawal of consent, rectification, erasure, a section 17(2) request or a review of an automated decision may appeal to the Authority in the form, manner and period to be prescribed, and the Authority must determine whether the refusal was lawful and tell both sides its decision with reasons.
Sending data overseas
The Act restricts transfers of personal data out of Sri Lanka, and section 10 of the 2025 amendment replaced the transfer provision wholesale. Under the new section 26(1), a controller or processor may engage in cross-border data flows only where it ensures compliance with Part I, Part II and sections 20 to 25 of the Act, and under section 26(2) it must adopt the instruments specified by a directive of the Authority under section 33(c) to secure binding and enforceable commitments from the recipient abroad. The adequacy-style list in the original section 26 has gone; what counts as an acceptable instrument now waits on the Authority's directive. Section 26(3) preserves the exceptions: explicit consent given after being told of the risks, performance of a contract with the data subject or pre-contractual steps at their request, the establishment, exercise or defence of legal claims, the public interest as defined in item (g) of Schedule I, an emergency threatening life, health or safety, mere transit through Sri Lanka, and any further condition prescribed. A public authority may not send abroad the categories of data the Minister prescribes under section 26(4) and (5), and "third country" now means anywhere outside Sri Lanka.
Two definitional changes in section 14 of the amendment matter for state-linked businesses. "Public authority" now means a Ministry, Department, Provincial Council or local authority and expressly excludes a public corporation and a company incorporated under the Companies Act No. 7 of 2007, so a state-owned company is an ordinary controller for the purposes of the Act. And a Data Protection Officer may be an outside third party who is not employed by the controller, provided they perform the section 20(5) functions.
Penalties
Enforcement sits with the Data Protection Authority. The Authority can impose a penalty of up to LKR 10 million for non-compliance, and for a repeat non-compliance it may impose an additional penalty of twice the amount imposed for the previous one.
What businesses should be doing now
Even though the substantive obligations are still being brought into force, preparing early is far easier than reacting to enforcement once it begins. Sensible first steps include:
- mapping what personal data the business holds, where it comes from, and where it flows;
- identifying a lawful basis for each type of processing;
- reviewing privacy notices, consent mechanisms and data-sharing arrangements;
- putting a process in place to handle data-subject requests within one month, with a documented reason and a notice to the data subject before that month ends if the two-month extension is needed;
- checking any transfers of data outside Sri Lanka against the Act's transfer rules.
The PDPA moves Sri Lanka into line with the data protection standards already used across much of the world. For anyone holding personal data, wherever they are based, compliance will be a continuing duty rather than a box ticked once.
An employer's obligations under the Act sit beside those in the employment statutes, which are set out in Employing Staff in Sri Lanka.
