Data Protection Monitor
Global Privacy & Data Protection Intelligence

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Sri Lanka Data Protection & Privacy Regulation

LK schema gdpri-v2 trajectory: not yet assessed in transition overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 73 claims · 27 sources in the cumulative register

Sri Lanka's Personal Data Protection Act regime enters a distinctive in-transition state this cycle.

Data collected Data published

AI-assembled from cited sources

Not covered: Children & Vulnerable Groups. Not fully checked this cycle: Data Subject Rights, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureIn transition9 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityData Protection Authority of Sri LankaPrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)2027-01-01PDPA Sections 2, 3, Part I and Part III come into force
Module coverage & confidence9 / 10 modules assessed0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed

Jurisdiction brief

Latest update · 4 November 2026

Lead Signal

Sri Lanka's data protection regime has moved from an open-ended wait for a commencement order to a dated one. Extraordinary Gazette No. 2498/16, dated 22 July 2026, appoints 1 January 2027 as the date on which Sections 2 and 3, along with Part I and Part III, of the Personal Data Protection Act, No. 9 of 2022 come into operation. That is a material change in posture: businesses and public bodies now have a fixed date against which to plan rather than an indefinite holding pattern. But the same commencement order appears to leave out Part VII, which carries the Act's administrative penalty regime; reporting on the order indicates that the fining mechanism will not switch on alongside the substantive obligations on 1 January 2027. The practical result is that core processing and accountability duties will have a confirmed start date while the ability to fine for breach of those duties does not, which materially softens what the regime can actually do to enforce itself at launch.

Key regulatory facts for Sri Lanka
Regulatory DimensionSri Lanka Standing Position
JurisdictionSri Lanka (LK)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 73 sourced findings)
Regulator & FrameworkComprehensive omnibus statute enacted and regulator operational, but core substantive Parts (I, II, III, VII) have had commencement dates repeatedly postponed and several implementing regulations remain in...
Lawful Processing & Special DataCore lawful-basis and special-category provisions exist in the Act text, but they sit in Parts (I-III) whose commencement date has been repeatedly postponed, and pseudonymisation/anonymisation rules were not located.
Data Subject RightsRights exist in principle under the Act, but implementing regulations governing procedure/deadlines were still in public-consultation draft form as of late 2024, and core Parts covering these rights had postponed...
Controller/Processor DutiesSubstantive duties are set out in the Act, but a cluster of implementing regulations were still in draft/consultation stage as of the last confirmed update, and the DPO obligation itself was narrowed by the pending...
Primary Instruments CitedDataGuidance, DataGuidance, Neelakandan & Neelakandan, Data Protection Authority of Sri Lanka, Ada Derana
Last Confirmed / Updated2026-11-04 (27 sources in cumulative register)

#

Comprehensive omnibus statute enacted and regulator operational, but core substantive Parts (I, II, III, VII) have had commencement dates repeatedly postponed and several implementing regulations remain in draft/consultation.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberComprehensive omnibus statute enacted and regulator operational, but core substantive Parts (I, II, III, VII) have had commencement dates repeatedly postponed and several implementing regulations remain in draft/consultation.

Sub-modules (5)

Regulator And AuthorityGreen

The Authority was established under Part V of the PDPA, which entered into force on 17 July 2023.

Claims (4):

  • Part V of the PDPA entered into force on 17 July 2023, thereby establishing the Data Protection Authority of Sri Lanka.
  • Data Protection Authority of Sri Lanka — Under the PDPA in August 2023; appointed its first permanent Director General in March 2026
  • Data Protection Authority of Sri Lanka — established and operational under Part V of the PDPA, in force from 17 July 2023
  • The DPA was established under the PDPA and has been operational since August 2023.

Act And InstrumentsAmber

PDPA No. 9 of 2022 was enacted/endorsed on 19 March 2022 and commences in phases via ministerial Order, with an October 2025 amendment further adjusting timelines and substantive provisions.

Claims (9):

  • The Personal Data Protection Act, No. 9 of 2022 was passed by the Parliament of Sri Lanka and endorsed on 19 March 2022.
  • Parts VI, VIII, IX and X of the PDPA entered into effect on 1 December 2023, with Parts I, II, III and VII scheduled to enter into effect on 18 March 2025 per a January 2024 commencement Order.
  • Sri Lanka's Parliament adopted amendments to the PDPA on 21 October 2025, which postponed operational dates, clarified automated-decision-making rights, limited DPO requirements, and introduced more flexible cross-border data transfer mechanisms.
  • A Gazette Extraordinary of 22 July 2026 sets 1 January 2027 as the commencement date for PDPA Sections 2-3, Part I and Part III.
  • A Gazette Order sets 1 January 2027 as the commencement date for core PDPA processing and controller/processor provisions.
  • Gazette Extraordinary No. 2498/16 — appoints 1 January 2027 as the date Section 2, Section 3, Part I and Part III of the PDPA come into operation; Part II and Part VII are not named and remain pending
  • Personal Data Protection (Amendment) Act, No. 22 of 2025 — The original grace-period provisions for operationalisation, meaning remaining substantive Parts commence only on a future Ministerial Gazette Order
  • Personal Data Protection (Amendment) Act, No. 22 of 2025 — substituted section 1(3) of the principal Act, removing fixed commencement deadlines and allowing the President to appoint commencement dates for remaining provisions by Gazette Order
  • The Data Protection Authority of Sri Lanka was established under Part V of the PDPA, in force from 17 July 2023.

Material ScopeGreen

The PDPA applies to processing of personal data generally but excludes purely personal/domestic/household processing.

Claims (1):

  • The PDPA does not apply to personal data processed purely for personal, domestic, or household purposes by an individual, or to data other than personal data (Section 2(3)).

Territorial ScopeGreen

The PDPA has extraterritorial reach, applying to controllers/processors outside Sri Lanka who offer goods/services to, or monitor the behaviour of, data subjects in Sri Lanka.

Claims (4):

  • The PDPA applies extraterritorially to processing that offers goods or services to data subjects in Sri Lanka (including targeted offerings) or that monitors the behaviour of data subjects in Sri Lanka, including profiling (Section 2(2)).
  • PDPA Section 2(1) — extends application to entities with no Sri Lankan establishment that offer goods or services to, or monitor the behaviour (including profiling) of, data subjects in Sri Lanka, commencing 1 January 2027
  • Personal Data Protection Act, No. 9 of 2022 — Applies to processing within Sri Lanka and extends extraterritorially to controllers/processors outside Sri Lanka offering goods/services to, or monitoring the behaviour of, individuals in Sri Lanka.
  • The PDPA's territorial extent is described as worldwide, reaching controllers/processors offering goods or services to, or monitoring, individuals in Sri Lanka.

Regulator Registration And FilingRed

No general controller/processor registration or filing regime with the Authority was identified in available sources; the closest analogue is the DPO-communication duty and the data-protection-management-programme obligation, which are treated under controller_processor_duties.

Category narrative 65 words

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) is the first comprehensive data-protection statute in the jurisdiction, establishing the Data Protection Authority of Sri Lanka. Commencement has been staggered by ministerial Order across 2023-2025, and a further October 2025 amendment postponed several operational dates and adjusted DPO/ADM/cross-border provisions, so the regime is best characterised as in transition rather than fully in force.

Periodic update · new data 2026-11-04

Regulator & Framework

Sri Lanka's data protection framework has reached a defined turning point. Extraordinary Gazette No. 2498/16, dated 22 July 2026, confirms 1 January 2027 as the date on which Sections 2 and 3, Part I and Part III of the Personal Data Protection Act, No. 9 of 2022 come into operation. This is a confirmed commencement, not a proposal, and it replaces what had previously been an open-ended wait for an order to be issued at all. The same order appears to exclude Part VII, which houses the administrative penalty regime; current reporting indicates that the enforcement-by-fine mechanism will not be implemented alongside the 1 January 2027 commencement date, though the precise statutory penalty figures and the possibility of a future separate commencement for that Part have not been independently confirmed against a primary gazette text.

Outlook

The period leading up to the commencement date is likely to surface further implementation detail, particularly on whether Part VII is activated by a later, separate order. Until that happens, the Act's substantive provisions will apply without the administrative fining mechanism that was originally built into the statute.

4 earlier distinct update(s)
Periodic update · new data 2026-10-25

Regulator & Framework

The institutional architecture of Sri Lanka's data protection regime has been in place since 17 July 2023, when the Data Protection Authority was established under Part V of the Personal Data Protection Act, No. 9 of 2022, per Gazette Extraordinary No. 2341/59. What has changed is not the existence of the Authority but the operative scope of the law it administers. A Gazette Extraordinary of 22 July 2026 fixes 1 January 2027 as the date on which Sections 2 and 3, Part I (Processing of Personal Data) and Part III (Controllers and Processors) come into operation. Until this order, the Act's substantive processing rules and the duties placed on controllers and processors had not been activated; the Authority existed, but the law it was built to administer in its central operative sense did not yet bind the market. This is the most material development in the jurisdiction's data protection framework in some time, moving the Act from an institution-building phase into an implementation phase on a known date.

The territorial reach of the Act is described, in secondary material, as worldwide in effect, extending to controllers and processors who offer goods or services to, or monitor, individuals in Sri Lanka, regardless of where those controllers or processors are established. This extraterritorial framing, if it holds as drafted, would place offshore businesses serving the Sri Lankan market within scope of the regime once Parts I and III take effect, a point that merits attention from organisations outside Sri Lanka whose services nonetheless reach individuals there. The precise statutory provision establishing this test was not independently verified against the Act's own text, and the claim should be read as reported rather than as a confirmed pinpoint citation.

Ahead of the January 2027 date, the Authority has begun a preparatory guidance programme, directing public authorities toward governance arrangements, data protection officer appointments and readiness assessments. A joint readiness session with the National Chamber of Commerce of Sri Lanka, scheduled for 28 October 2026 and featuring the Authority's Director General, indicates the regulator is now engaging directly with industry and civil-society stakeholders as the commencement date approaches, rather than confining its communications to the public sector alone.

What remains unresolved structurally is the staggered nature of the Act's commencement. Parts I and III are now dated; Part II, carrying data subject rights, is not. A regime that activates controller and processor obligations before activating the rights those obligations are meant to serve is an unusual sequencing choice, and it is one regulators and affected organisations alike will need to navigate through the first year of operation.

Outlook

Between now and 1 January 2027, expect the Authority to expand its guidance programme beyond the public sector, likely issuing sector-specific or general readiness circulars addressed to private controllers and processors as the operative date nears. The territorial-scope question, specifically whether the extraterritorial test will be applied against offshore entities serving the Sri Lankan market, is likely to draw clarifying guidance or early enforcement signalling once Part III is in force. Whether a commencement order for Part II follows promptly, or lags well behind Parts I and III, will determine whether the asymmetry between binding duties and enforceable rights is a brief transitional feature or a more durable structural gap in the regime as implemented.

Periodic update · new data 2026-10-18

Regulator & Framework

Sri Lanka's data protection framework reached a significant milestone with an Extraordinary Gazette Order issued by the President on 22 July 2026, appointing 1 January 2027 as the commencement date for Sections 2 and 3, Part I (Processing of Personal Data) and Part III (Controllers and Processors) of the Personal Data Protection Act, No. 9 of 2022. Prior to this Order, the remaining parts of the PDPA were understood to come into operation only on a date the responsible Minister would appoint, with no fixed timeline. The Order replaces that open-ended uncertainty with a specific date just over two months away from this writing.

The Data Protection Authority of Sri Lanka, the regulator established under the Act, has been operational since August 2023, with Part V (which establishes the Authority itself) in force from 17 July 2023. The Authority therefore already exists and has institutional standing, even though the substantive processing and controller/processor obligations it will oversee are not yet binding. This sequencing, regulator first, substantive duties later, means the DPA has had over three years of institutional existence ahead of the obligations its core mandate concerns becoming enforceable.

The practical effect of the Gazette Order is to convert the PDPA from a statute whose substantive core was indefinitely deferred into one with a concrete, near-term commencement date for the processing-of-personal-data provisions (Part I) and the duties imposed on controllers and processors (Part III). Part II, covering data subject rights, remains without a commencement date, meaning that from 1 January 2027, organisations will owe processing and controller/processor duties under a regime in which the rights those duties are meant to protect are not yet themselves in force.

Outlook

The period between now and 1 January 2027 is the operative implementation window for any organisation subject to the PDPA. The absence of a commencement date for Part II (data subject rights) is the clearest open question for this module going forward: a data protection framework in which controller obligations are binding but subject rights are not creates an asymmetric compliance landscape that organisations should track as further Gazette Orders, if any, are issued.

Periodic update · new data 2026-10-11

Regulator & Framework

The Personal Data Protection Act, No. 9 of 2022 has, as at 22 July 2026 dated reporting, acquired its first confirmed substantive commencement date since certification. Gazette Extraordinary No. 2498/16 appoints 1 January 2027 as the date Section 2, Section 3, Part I and Part III of the Act come into operation. This follows a period in which an earlier commencement target — 18 March 2025, for Parts I, II, III and VII together — was repealed by Gazette No. 2427/34, dated 14 March 2025. That repeal left those four Parts without any confirmed implementation date for more than a year, a gap the new Order now partially closes.

The partial nature of the 2026 Order is the central framework fact for this module. It names Section 2, Section 3, Part I and Part III. It does not name Part II (data subject rights) or Part VII (enforcement and penalties) among the provisions brought into operation. Whether those two Parts commence by some separate or associated mechanism not captured in the commentary reviewed, or whether they remain pending beyond 1 January 2027, is not resolved in the sources available. This is a gap in what has been confirmed, not a finding that those Parts are excluded.

Separately from the commencement question, the Act's general framework includes an extraterritorial application test: it applies to processing within Sri Lanka and extends to controllers and processors located outside Sri Lanka that offer goods or services to, or monitor the behaviour of, individuals in Sri Lanka. That test sits in the Act's general provisions rather than within a Part specifically confirmed by the 2026 Order, so the practical operative status of extraterritorial reach follows whatever provisions the Order actually brings into force.

The overall trajectory for this module is escalating: after a multi-year pattern of delay and at least one outright repeal of a prior commencement target, the Act now has a dated, named set of provisions due to take effect on 1 January 2027, even though the full scope of that effect remains to be confirmed against the primary Gazette text.

Outlook

The near-term question is whether the Data Protection Authority or a further Gazette notice clarifies the status of Part II and Part VII ahead of 1 January 2027. Confirmation either way would resolve a material open question: a regime that imposes controller and processor duties without a correspondingly confirmed individual-rights framework or penalty regime is a materially different proposition than one in which all three commence together. Until that clarification appears, the framework's described status as at 1 January 2027 should be read as covering the confirmed provisions only.

Periodic update · new data 2026-10-05

Regulator & Framework

Sri Lanka's Personal Data Protection Authority, established and operational under Part V of the Personal Data Protection Act since that Part came into force on 17 July 2023, now sits alongside a significantly clarified commencement timeline for the remainder of the principal Act. The clarification traces to the Personal Data Protection (Amendment) Act, No. 22 of 2025, which substituted section 1(3) of the principal Act. That substitution removed the fixed commencement deadlines the original Act had carried and replaced them with a mechanism allowing the President to appoint commencement dates for the Act's remaining provisions by Gazette Order, on a rolling basis, as each becomes ready for implementation.

The first exercise of that mechanism is Gazette Extraordinary No. 2498/16, which appoints 1 January 2027 as the date on which Section 2, Section 3, Part I and Part III of the Act come into operation. This is a material development because it converts what had been an open architecture, a framework capable of commencing but without any specific date attached to most of its substantive provisions, into a dated obligation for a defined set of provisions. Part I carries the Act's lawful-processing and special-category-data rules; Part III carries controller and processor duties, including the Section 12 requirement that every controller implement a documented Data Protection Management Programme of internal controls. Section 2(1) is a particularly consequential inclusion: it extends the Act's application to entities with no establishment in Sri Lanka that nonetheless offer goods or services to, or monitor the behaviour, including profiling, of, data subjects located in Sri Lanka. That extraterritorial reach now has a fixed effective date, where previously its activation depended on an unscheduled future Gazette.

The commencement order is equally informative in what it omits. Part II, which carries the Act's data-subject-rights provisions, is not named in Gazette 2498/16, and nor is Part VII, which carries the Authority's enforcement powers, including the capacity to impose administrative penalties of up to LKR 10 million per instance of non-compliance, doubling on repetition. The practical consequence is a regime that, from 1 January 2027, will impose extraterritorial-scope obligations and controller/processor duties on covered entities without the data-subject-rights provisions that would let individuals exercise corresponding entitlements, and without the administrative-penalty mechanism that would give the Authority its primary enforcement lever over those same obligations. This is not a drafting oversight so much as the structural consequence of the amendment's own design: the President may commence provisions individually as they become ready, and Parts II and VII evidently were not assessed as ready at the time Gazette 2498/16 was issued.

The Authority itself has been operational since 2023 under Part V, which governs its establishment and institutional structure, together with whatever mandate Parts VI, VIII, IX and X confer; what rules, if any, the Authority has issued under that standing mandate in the period since establishment has not been resolved in the material available this cycle. The Authority's institutional existence and the commencement of the extraterritorial-scope and controller-duty provisions are therefore two separate facts: the regulator has existed and operated for over three years, while the substantive obligations it will eventually supervise most broadly are only now receiving a confirmed effective date, and not yet a complete one.

Outlook

The clearest open question for this module is whether a further commencement order will name Part II and Part VII ahead of, on, or after 1 January 2027, and whether any such order will arrive with enough lead time for covered entities to align data-subject-rights processes and anticipate administrative-penalty exposure before those provisions take effect. Until such an order issues, the practical posture for any entity assessing Sri Lankan exposure is that extraterritorial-scope and controller/processor obligations will bind from 1 January 2027 as scheduled, while the corresponding rights and enforcement architecture remain in the undated status the 2025 amendment created and has not yet resolved.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (18)
  1. Probable DataGuidance — Part V of the PDPA entered into force on 17 July 2023, thereby establishing the Data Protection Authority of Sri Lanka. observed
  2. Probable DataGuidance — The Personal Data Protection Act, No. 9 of 2022 was passed by the Parliament of Sri Lanka and endorsed on 19 March 2022. observed
  3. Probable DataGuidance — Parts VI, VIII, IX and X of the PDPA entered into effect on 1 December 2023, with Parts I, II, III and VII scheduled to enter into effect on 18 March 2025 per a January 2024 commencement Order. observed
  4. Probable DataGuidance — Sri Lanka's Parliament adopted amendments to the PDPA on 21 October 2025, which postponed operational dates, clarified automated-decision-making rights, limited DPO requirements, and introduced more flexible cross-border data transfer mechanisms. observed
  5. Probable DataGuidance — The PDPA does not apply to personal data processed purely for personal, domestic, or household purposes by an individual, or to data other than personal data (Section 2(3)). observed
  6. Probable DataGuidance — The PDPA applies extraterritorially to processing that offers goods or services to data subjects in Sri Lanka (including targeted offerings) or that monitors the behaviour of data subjects in Sri Lanka, including profiling (Section 2(2)). observed
  7. Probable Neelakandan & Neelakandan — A Gazette Extraordinary of 22 July 2026 sets 1 January 2027 as the commencement date for PDPA Sections 2-3, Part I and Part III. observed
  8. Probable Data Protection Authority of Sri Lanka — A Gazette Order sets 1 January 2027 as the commencement date for core PDPA processing and controller/processor provisions. observed
  9. Probable Ada Derana — Gazette Extraordinary No. 2498/16 — appoints 1 January 2027 as the date Section 2, Section 3, Part I and Part III of the PDPA come into operation; Part II and Part VII are not named and remain pending observed
  10. High Data Protection Authority of Sri Lanka — Data Protection Authority of Sri Lanka — Under the PDPA in August 2023; appointed its first permanent Director General in March 2026 observed
  11. High DLA Piper — Personal Data Protection (Amendment) Act, No. 22 of 2025 — The original grace-period provisions for operationalisation, meaning remaining substantive Parts commence only on a future Ministerial Gazette Order observed
  12. Probable Concentric AI — Data Protection Authority of Sri Lanka — established and operational under Part V of the PDPA, in force from 17 July 2023 observed
  13. Probable Neelakandan & Neelakandan — Personal Data Protection (Amendment) Act, No. 22 of 2025 — substituted section 1(3) of the principal Act, removing fixed commencement deadlines and allowing the President to appoint commencement dates for remaining provisions by Gazette Order observed
  14. Probable Ada Derana — PDPA Section 2(1) — extends application to entities with no Sri Lankan establishment that offer goods or services to, or monitor the behaviour (including profiling) of, data subjects in Sri Lanka, commencing 1 January 2027 observed
  15. Probable Wikipedia — Personal Data Protection Act, No. 9 of 2022 — Applies to processing within Sri Lanka and extends extraterritorially to controllers/processors outside Sri Lanka offering goods/services to, or monitoring the behaviour of, individuals in Sri Lanka. observed
  16. Probable https://www.dpa.gov.lk/ — The DPA was established under the PDPA and has been operational since August 2023.
  17. Probable Concentric AI — The Data Protection Authority of Sri Lanka was established under Part V of the PDPA, in force from 17 July 2023. observed
  18. Uncertain Wikipedia — The PDPA's territorial extent is described as worldwide, reaching controllers/processors offering goods or services to, or monitoring, individuals in Sri Lanka. observed

#

Core lawful-basis and special-category provisions exist in the Act text, but they sit in Parts (I-III) whose commencement date has been repeatedly postponed, and pseudonymisation/anonymisation rules were not located.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA) — Schedules I, II, III
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberCore lawful-basis and special-category provisions exist in the Act text, but they sit in Parts (I-III) whose commencement date has been repeatedly postponed, and pseudonymisation/anonymisation rules were not located.
D2 · Lawful Processing — Full Module Record4 sub-modules · 42 words · 7 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Rights exist in principle under the Act, but implementing regulations governing procedure/deadlines were still in public-consultation draft form as of late 2024, and core Parts covering these rights had postponed commencement.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberRights exist in principle under the Act, but implementing regulations governing procedure/deadlines were still in public-consultation draft form as of late 2024, and core Parts covering these rights had postponed commencement.

Sub-modules (5)

Access RightAmber

The Authority sought public input on draft fee regulations for data-subject-rights requests, implying an access/rights-request mechanism is being operationalised, but the underlying statutory access-request procedure text was not retrieved.

Claims (2):

  • The Data Protection Authority of Sri Lanka sought public input on draft fee regulations for data-subject-rights requests under the PDPA.
  • Part II of the PDPA (data subject rights) remains without an announced commencement date.

Rectification And ErasureRed

General strengthening of data-subject rights is stated as a Section 1/PDPA objective; specific rectification/erasure mechanics were not located.

Restriction And ObjectionRed

No specific restriction-of-processing or objection-right provision text was retrieved in available sources.

Data PortabilityRed

No specific data-portability provision was identified in available sources.

Deadlines And Response WindowsAmber

The Authority ran a 2024 consultation on draft regulations for data-subject rights and appeals, and separately on fee regulations for rights requests, indicating response-window mechanics were still being finalised via secondary legislation as of the survey window.

Claims (2):

  • The Authority sought public input on draft regulations for data subjects' rights and appeals under the PDPA, extending the feedback deadline to 15 November 2024.
  • PDPA Part II — Part II, covering data-subject rights, is not named in the 22 July 2026 commencement Order and has no confirmed effective date
Category narrative 58 words

The PDPA is described as strengthening data-subject rights, and the Authority has run consultations on draft regulations for DSAR rights and appeals and fee schedules for rights requests, but concrete statutory deadlines and detailed mechanics for access, rectification, erasure, restriction, objection and portability were not located in available secondary sources — much of this remains in draft-regulation form.

Sources and claims (4)
  1. Probable DataGuidance — The Data Protection Authority of Sri Lanka sought public input on draft fee regulations for data-subject-rights requests under the PDPA. observed
  2. Probable DataGuidance — The Authority sought public input on draft regulations for data subjects' rights and appeals under the PDPA, extending the feedback deadline to 15 November 2024. observed
  3. Probable Ada Derana — PDPA Part II — Part II, covering data-subject rights, is not named in the 22 July 2026 commencement Order and has no confirmed effective date observed
  4. Uncertain HashtagCoders — Part II of the PDPA (data subject rights) remains without an announced commencement date. observed

#

Substantive duties are set out in the Act, but a cluster of implementing regulations were still in draft/consultation stage as of the last confirmed update, and the DPO obligation itself was narrowed by the pending 2025 amendment.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberSubstantive duties are set out in the Act, but a cluster of implementing regulations were still in draft/consultation stage as of the last confirmed update, and the DPO obligation itself was narrowed by the pending 2025 amendment.
Periodic update · new data 2026-11-04

Controller/Processor Duties

Part III of the Personal Data Protection Act, No. 9 of 2022, which carries controller and processor obligations, is confirmed to commence on 1 January 2027 under Extraordinary Gazette No. 2498/16. In preparation for that date, the Data Protection Authority of Sri Lanka has issued Personal Data Protection Circular No. 01/2026, which replaces the Authority's earlier Circular No. 01/2024 issued 13 September 2024, to provide implementation guidance to public-sector bodies ahead of Part III taking effect. The circular is guidance rather than binding law, but its issuance indicates the regulator is actively working to ready public bodies for the obligations that will apply from the commencement date, even though no legal penalty regime will be active alongside those obligations at that point given the exclusion of Part VII.

Outlook

Whether equivalent implementation guidance will be extended to private-sector controllers and processors ahead of 1 January 2027, and how compliance will be monitored in the absence of an active penalty mechanism, are the two questions most likely to define this area over the coming months.

Periodic update · new data 2026-10-25

Controller/Processor Duties

Part III of the Personal Data Protection Act, which sets out the duties placed on controllers and processors, is now dated to commence on 1 January 2027, per the Gazette Extraordinary of 22 July 2026. This is the second limb, alongside Part I's processing rules, brought into operation by the same commencement order, and it is the limb most directly relevant to how organisations structure their internal data governance ahead of the operative date.

The Data Protection Authority has moved ahead of the commencement date itself to issue preparatory guidance. Circular No. 01/2026 is understood to direct public authorities to establish governance arrangements, appoint data protection officers where required, implement Data Protection Management Programmes, and conduct audits, gap assessments and data protection impact assessments in advance of the Part III commencement date. This circular is addressed, at least in its current form, to public authorities specifically, rather than to the private sector broadly, though the substantive content, DPO appointment, DPMPs, audits and impact assessments, mirrors the kind of accountability architecture that private-sector controllers and processors operating in Sri Lanka will also need to build before January 2027 if they fall within the Act's scope.

The sequencing here is notable: the regulator is using the window between the commencement order and its effective date to drive readiness activity, rather than waiting for the law to take effect before engaging with obliged entities. The 28 October 2026 industry readiness session, co-hosted with the National Chamber of Commerce of Sri Lanka and featuring the Authority's Director General and senior directors, is a further and more public-facing extension of this same readiness push, this time reaching beyond the public sector into the wider business community.

What is not yet confirmed is the full scope of controller and processor obligations as they will read once Part III is operative, beyond the governance, DPO, DPMP, audit and impact-assessment elements already signalled through the Circular. Organisations should treat the Circular's content as an indicator of regulatory expectation and direction rather than as the complete and final statement of Part III's requirements.

Outlook

Expect the Data Protection Authority's guidance programme to extend from the public sector into private-sector controllers and processors as 1 January 2027 approaches, likely with sector-specific variants given the readiness session's industry co-sponsorship. The accountability architecture already signalled, governance structures, DPO appointment, DPMPs, audits, gap assessments and impact assessments, is a reasonable basis for controllers and processors to begin internal readiness work now, ahead of further detail that may follow from the regulator before the commencement date.

Periodic update · new data 2026-10-18

Controller/Processor Duties

Controller and processor duties under Part III of the Personal Data Protection Act, No. 9 of 2022 now have a confirmed commencement date of 1 January 2027, set by an Extraordinary Gazette Order issued by the President on 22 July 2026. This is the first time these duties have had anything other than an open-ended, Minister-appointed commencement date, and it gives regulated entities a fixed implementation deadline for the first time since the Act's original 2022 enactment.

Ahead of that date, the Data Protection Authority of Sri Lanka issued Personal Data Protection Circular No. 01/2026 on 8 August 2026, replacing the earlier Circular No. 01/2024. This circular provides transition-period implementation guidance, directing entities, including public authorities, to begin preparatory steps such as data protection impact assessments and internal audits ahead of Part III's commencement. The circular itself is not a binding legal instrument; it is preparatory guidance from the regulator rather than a source of enforceable obligation, and its content should be read as indicating the DPA's expectations rather than a legal requirement in its own right until Part III itself takes effect.

The combination of a fixed commencement date and an active transition circular indicates that the DPA is treating the run-up to 1 January 2027 as an implementation period rather than a continuation of indefinite deferral. For controllers and processors operating in Sri Lanka, this is the first concrete signal that compliance preparation, rather than continued monitoring of commencement uncertainty, is now the operative posture.

Outlook

The period to 1 January 2027 is the window in which controllers and processors should expect further DPA guidance consistent with Circular No. 01/2026's transition-period framing. Whether additional circulars or implementing regulations will follow before the commencement date, and whether enforcement mechanisms under Part VII will be scheduled in parallel, remain open questions this cycle's evidence does not resolve.

D4 · Controller & Processor — Full Module Record7 sub-modules · 61 words · 13 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

A transfer-mechanism framework exists in the Act, but implementing directives were in draft/consultation form and no adequacy decisions to or from Sri Lanka were identified.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberA transfer-mechanism framework exists in the Act, but implementing directives were in draft/consultation form and no adequacy decisions to or from Sri Lanka were identified.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 74 words · 6 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

General cross-sector coordination is committed to in policy statements, but dedicated sectoral overlay statutes/regulations for financial services, health, employment, credit, education, or insurance were not located.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberGeneral cross-sector coordination is committed to in policy statements, but dedicated sectoral overlay statutes/regulations for financial services, health, employment, credit, education, or insurance were not located.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 63 words · 4 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Direct marketing is explicitly addressed by statute; other adtech-adjacent sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) have no located statutory or DPA-guidance basis.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA), Part IV
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberDirect marketing is explicitly addressed by statute; other adtech-adjacent sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) have no located statutory or DPA-guidance basis.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 31 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

ADM and profiling are addressed at a scope/definitional level and via a reported 2025 amendment, but dedicated biometric, genetic-data, and AI-risk-assessment regimes were not confirmed as enacted.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberADM and profiling are addressed at a scope/definitional level and via a reported 2025 amendment, but dedicated biometric, genetic-data, and AI-risk-assessment regimes were not confirmed as enacted.
Periodic update · new data 2026-11-04

Algorithmic, Biometric & Surveillance Governance

The Online Safety Act, No. 9 of 2024 remains the central friction point for surveillance-adjacent governance in Sri Lanka. The Online Safety Commission established under the Act holds broad powers to compel disclosure of information and to direct the removal of online content. Civil-society organisations and international legal submissions have argued that these powers compromise digital privacy because they operate without judicial-warrant safeguards of the kind typically attached to compulsory-disclosure powers elsewhere. The government is understood to have stated that it will not enforce the Act in its current form pending amendment, which suggests an acknowledged tension between the Act as drafted and privacy protections, but whether amendment text has actually been tabled or passed in the legislature has not been confirmed as at this writing.

Outlook

The Act's powers remain formally in force regardless of the stated non-enforcement posture, so any shift from policy-level restraint to actual legislative amendment would be the development most likely to resolve the current tension between the Commission's disclosure powers and privacy safeguards.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 65 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Targeted searches for children/minors provisions in the PDPA and DPA guidance returned no relevant results.

Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — Not assessedTargeted searches for children/minors provisions in the PDPA and DPA guidance returned no relevant results.

Sub-modules (5)

Age VerificationRed

No age-of-consent or age-verification provision was identified.

Minor Profiling BansRed

No minor-specific profiling ban was identified.

Education SettingsRed

No education-setting-specific data-protection rule was identified.

Dependent AdultsRed

No dependent-adult-specific protection was identified.

Category narrative 24 words

No PDPA provision or Authority guidance addressing age of consent, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections was located in available sources.

#

Enforcement powers exist on the statute's face, but no confirmed enforcement decisions/fines were located, and the underlying substantive obligations remain subject to a shifting commencement timetable.

Primary frameworkPersonal Data Protection Act, No. 9 of 2022 (PDPA)
Supervisory authorityData Protection Authority of Sri Lanka
Traffic-light rationale — AmberEnforcement powers exist on the statute's face, but no confirmed enforcement decisions/fines were located, and the underlying substantive obligations remain subject to a shifting commencement timetable.
Periodic update · new data 2026-11-04

Enforcement & Redress

The clearest enforcement-relevant development this period is what the July 2026 commencement order leaves out rather than what it brings in. Extraordinary Gazette No. 2498/16 confirms 1 January 2027 as the commencement date for Parts I and III of the Personal Data Protection Act, No. 9 of 2022, but Part VII, which contains the administrative penalty regime, does not appear among the Parts brought into operation. This means that from the commencement date, the Act's substantive processing and controller/processor obligations will apply without the fining mechanism originally built into the statute to enforce them. The precise penalty figures as drafted in Part VII, and whether any indication exists of a future separate commencement for that Part, have not been independently confirmed against a primary gazette text.

Outlook

Whether Part VII is activated on a delayed track of its own is the single most consequential open question for how much practical force the regime carries once its substantive provisions take effect on 1 January 2027.

Periodic update · new data 2026-10-25

Enforcement & Redress

The enforcement architecture under Sri Lanka's Personal Data Protection Act remains, for the moment, a reported rather than fully confirmed structure. A penalty-escalation rule is understood to apply to repeated non-compliance, under which a subsequent breach may attract a penalty of twice the amount previously imposed for an earlier instance of non-compliance. This is an escalating rather than a flat per-breach penalty model, which if confirmed against the Act's primary text would create a meaningful deterrent effect for organisations with a prior compliance history under the Act. The base penalty tiers, the precise statutory provision establishing the escalation, and the Part under which this enforcement mechanism sits were not independently confirmed, and the claim should be treated as reported pending verification.

No enforcement action, investigation, or redress mechanism activation has been identified for Sri Lanka within the window, which is unsurprising given that the Act's core processing and controller and processor duties, Parts I and III, do not themselves become operative until 1 January 2027. Enforcement activity of the kind the penalty-escalation rule contemplates cannot meaningfully begin until the underlying obligations it attaches to are themselves in force.

What has occurred instead is preparatory and readiness-building activity ahead of that enforcement capability becoming live. The Data Protection Authority and the National Chamber of Commerce of Sri Lanka are holding a readiness session, "PDPA 2027: From Law to Practice," on 28 October 2026, with the Authority's Director General and senior directors in attendance. Sessions of this kind, run by the regulator itself in partnership with a leading industry body, are a visible signal that the Authority is positioning itself to move into an active enforcement posture once the January 2027 commencement date is reached, rather than treating enforcement capability as a matter to be built only after the law takes effect.

No cross-border criminal-justice data-sharing arrangement specific to Sri Lanka, such as a mutual legal assistance arrangement or an accession to an international cybercrime-cooperation instrument, was identified. This remains an open question for the jurisdiction's redress and cross-border enforcement cooperation posture.

Outlook

The period before 1 January 2027 is best read as the Authority's run-up to an enforcement capability that does not yet have a live legal basis to act against Part I or Part III breaches. Expect further detail on the penalty structure, including base tiers and the governing provision, to surface as the commencement date nears and as readiness sessions such as the 28 October 2026 event generate more granular regulator commentary. Confirmation or otherwise of a cross-border data-sharing or mutual-assistance arrangement remains an open item to track.

Periodic update · new data 2026-10-18

Enforcement & Redress

Enforcement and redress under the Personal Data Protection Act, No. 9 of 2022 remains the module furthest behind the Act's substantive progress. While an Extraordinary Gazette Order of 22 July 2026 fixed 1 January 2027 as the commencement date for Part I (processing) and Part III (controller/processor duties), Part VII, which contains the Act's penalty provisions, has not received a commencement date and remains pre-commencement.

Secondary commentary states that the PDPA defines penalties of up to LKR 10 million per violation, but this figure sits within Part VII and has not been independently confirmed at pinpoint level against the Act's own text; the finding rests on a single T3 secondary source rather than a located primary provision. Until Part VII is brought into force, and until its specific penalty provisions are confirmed against primary text, the practical enforcement exposure facing a controller or processor that breaches its Part III duties from 1 January 2027 onward remains legally undefined.

The Data Protection Authority of Sri Lanka has been operational since August 2023 and has demonstrated regulatory activity through its issuance of Circular No. 01/2026 on 8 August 2026, providing transition guidance ahead of commencement. This shows an active regulator notwithstanding the absence of a commenced enforcement regime, but a circular of this kind carries no penalty or sanctioning power in itself.

Outlook

The central gap to track is whether and when Part VII will receive its own commencement date. Until it does, the Act's core processing and controller/processor duties will take effect on 1 January 2027 without a confirmed, legally binding penalty regime standing behind them, a structural gap between substantive obligation and enforceable consequence that organisations assessing compliance risk in Sri Lanka should treat as a live and unresolved question.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 91 words · 12 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 73 claim(s) (74 category placement(s)), 27 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not settled (12 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (35 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redresscollective redress and class actions
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 82Enforcement & Redresscollective redress and class actions
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties