Sri Lanka. Comprehensive data protection. Act
PDPAPersonal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025)
Partly verified
Medium confidence.Status of the March 2025 commencement is inconsistent across sources; treat 1 Jan 2027 as operative date for core obligations. Date of certification of original Act (2022-03-19) from general knowledge.
§1Summary
- Synopsis
GDPR-style law setting lawful processing grounds, controller and processor obligations (DPO, DPIA, breach notification), data subject rights and cross-border transfer controls, overseen by the Data Protection Authority. The 2025 amendment softened DPO, DPIA and transfer rules and gave the Minister flexible commencement powers.
- Key themes
- Unique features
2025 amendment replaced the adequacy mechanism with DPA-specified transfer instruments, allowed outsourced DPOs and made DPIA submission only on DPA request; DSAR deadline is one month (extendable by two).
- SaaS relevance
Applies to foreign SaaS offering goods/services to, or monitoring, people in Sri Lanka from 1 January 2027, with processor obligations under Part III.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority within 72h (draft rules); individuals where high risk
- DPO
- Conditional
- Cross-border transfers
- Transfers allowed if exporter ensures Act compliance and uses a DPA-specified instrument (BCRs, contracts, codes, certification); limited derogations; Minister may bar export of certain public-authority data
- Maximum penalty
- Up to LKR 10 million per non-compliance; double for repeat (Part VII not yet in force)
§3Dates
- Key dates
- Adopted
- In force
- Part V (DPA) operative July 2023; Parts VI, VIII, IX, X from 2023-12-01; earlier-announced 2025-03-18 date for Parts I-III and VII did not take effect as planned; Amendment Act No. 22 of 2025 (passed 2025-10-21, certified 2025-10-30) removed fixed commencement windows; Order dated 2026-07-13 (Gazette 2498/16 of 2026-07-22) brings ss2-3, Part I and Part III into force 2027-01-01; Parts II (rights), IV (solicited messages) and VII (penalties) await further orders.
§4Text and authority
- Text
- Authoritative text dpa.gov.lk
- Authority
- Data Protection Authority of Sri Lanka
§5Where it applies
- Domestic law of
- Sri Lanka
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Status of the March 2025 commencement is inconsistent across sources; treat 1 Jan 2027 as operative date for core obligations. Date of certification of original Act (2022-03-19) from general knowledge.