--- title: "Sri Lanka Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/sri-lanka/ source_html: /jurisdictions/sri-lanka/index.html description: "Sri Lanka data protection and privacy regulation: 10 categories, 73 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: 2857be576a712366bcb78ac0b12991633236f8fb163b01b844f95d28c125240d generator: "fe-fleet/md-twin@1.0" --- # Sri Lanka Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Sri Lanka Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/sri-lanka/), [World Payments](https://payments.gi/jurisdictions/sri-lanka/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 73 claims · 27 sources in the cumulative register Download report (PDF) Expand all Sri Lanka's Personal Data Protection Act regime enters a distinctive in-transition state this cycle. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Children & Vulnerable Groups. Not fully checked this cycle: Data Subject Rights, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SRI-LANKA)[Build Report](/reports/?j=SRI-LANKA)[Compare](/compare/?j=SRI-LANKA) Framework posture In transition 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Data Protection Authority of Sri Lanka Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2027-01-01 PDPA Sections 2, 3, Part I and Part III come into force Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 0 Red categories 57 Sub-modules 73 Claims 2 Tier-1 sources Traffic-light mix 9 amber 1 n/a (sums to 10 rendered categories; click to filter) No red categories; 28 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,100 Full executive summary 465 ###### Latest update · 4 November 2026 #### Lead Signal Sri Lanka's data protection regime has moved from an open-ended wait for a commencement order to a dated one. Extraordinary Gazette No. 2498/16, dated 22 July 2026, appoints 1 January 2027 as the date on which Sections 2 and 3, along with Part I and Part III, of the Personal Data Protection Act, No. 9 of 2022 come into operation. That is a material change in posture: businesses and public bodies now have a fixed date against which to plan rather than an indefinite holding pattern. But the same commencement order appears to leave out Part VII, which carries the Act's administrative penalty regime; reporting on the order indicates that the fining mechanism will not switch on alongside the substantive obligations on 1 January 2027. The practical result is that core processing and accountability duties will have a confirmed start date while the ability to fine for breach of those duties does not, which materially softens what the regime can actually do to enforce itself at launch. #### Other Developments Ahead of the Part III commencement, the Data Protection Authority of Sri Lanka has issued Personal Data Protection Circular No. 01/2026, replacing an earlier circular from September 2024, to give public-sector bodies implementation guidance in advance of the obligations taking effect. This is guidance rather than binding law, but it signals that the regulator is actively preparing the public sector for the shift, even as private-sector readiness signals are less visible in what has surfaced so far. Separately, the Online Safety Act, No. 9 of 2024 continues to sit awkwardly alongside the data protection framework. The Online Safety Commission holds broad powers to compel disclosure of information and to direct content removal, and civil society and international legal submissions have argued that these powers compromise digital privacy because they lack judicial-warrant safeguards. The government has stated that it will not enforce the Act in its current form pending amendment, but whether any amendment has actually been tabled or passed has not been confirmed as at this writing, so the Act's surveillance-adjacent powers remain on the books even as enforcement is paused by policy rather than by law. #### Cross-Monitor Connections The commencement timeline and the unresolved penalty gap touch directly on how enforceable the data protection regime will be once live, a question that connects to how financial and payments-sector regulators separately handle data-related compliance expectations; readers following that thread should look to the relevant monitor covering that ground rather than this one. #### Outlook The period between now and 1 January 2027 is the window in which two open questions should resolve: whether Part VII is brought into operation on a delayed track of its own, and whether the Online Safety Act amendment process produces text that narrows the Commission's disclosure and takedown powers. Until the penalty regime question is settled, the Personal Data Protection Act's core obligations will take effect against a weaker enforcement backdrop than the Act as originally structured contemplated, and the practical weight of the regime will depend heavily on whether a separate commencement order eventually activates Part VII. 4 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Sri Lanka's Personal Data Protection Act regime enters a distinctive in-transition state this cycle. The Data Protection Authority of Sri Lanka, established under the PDPA in August 2023, appointed its first permanent Director General in March 2026, a concrete institutional capacity-building milestone. At the same time, the Personal Data Protection (Amendment) Act, No. 22 of 2025 -- certified 30 October 2025 -- removed the original grace-period provisions for operationalisation, meaning the PDPA's remaining substantive Parts now commence only upon a future Ministerial Gazette Order rather than on a fixed schedule. As of June 2026, no such Ministerial Gazette Order commencing the PDPA's substantive Parts had been published. The result is a regulator that is institutionally live and building capacity, sitting atop a substantive legal framework with no fixed commencement date -- an open-ended regulatory uncertainty for market participants that is the central development of this cycle. #### Other Developments No formal adequacy decisions have been issued. The Data Protection Authority of Sri Lanka has not issued any formal adequacy decisions as of May 2026, and controllers and processors may rely on appropriate safeguards for international transfers in the interim. This is a High-confidence, sourced negative finding: the cross-border transfer regime exists in the PDPA's design, which draws from the EU GDPR in structuring its lawful-processing bases and data-subject rights framework, but has not yet been operationalised through any adequacy mechanism, consistent with the substantive Parts' not-yet-commenced status generally. Sector-specific statutes remain the only operative source of data-handling obligations. The Banking Act No. 30 of 1988 continues to apply alongside the not-yet-operative PDPA as a sector-specific statute governing financial-sector personal data. In the absence of PDPA substantive commencement, this Act functions as one of the only operative sources of data-handling obligations in its sector, a gap that will persist until the Ministerial Gazette Order is published. #### Cross-Monitor Connections Sri Lanka's crypto and financial-integrity developments this cycle -- the proposed virtual-asset regulatory framework and the Cabinet-approved public-official crypto-declaration measure -- were clarified by the Deputy Minister of Digital Economy as proceeding on a track distinct from the concurrently progressing Cyber Security Bill, which addresses network and technical security rather than data-protection questions; that Cyber Security Bill sits closer to the crypto and financial-integrity monitors' remits than to this one, and is noted here only to mark the scope boundary rather than to analyse it. This scope-boundary clarification forecloses treating the Cyber Security Bill's progress as a data-protection-track development. No adtech, algorithmic-governance, or children's-data development connecting to the advennt or world-payments monitors was evidenced this cycle. #### Outlook The item most likely to change Sri Lanka's data-protection picture is publication of the Ministerial Gazette Order commencing the PDPA's substantive Parts; until that order is published, controller/processor duties, data-subject rights, and the Authority's enforcement powers remain legislated but not practically operative. The Authority's institutional build-out, evidenced by the March 2026 Director General appointment, suggests capacity is being readied ahead of that commencement, but no date for the order has been indicated in this cycle's evidence. A second item to watch is whether the Authority issues any interim guidance -- short of a full Gazette commencement order -- addressing cross-border transfer practice, given that no formal adequacy decision exists and controllers currently rely on unspecified appropriate safeguards with no published standard-contractual-clauses or binding-corporate-rules template evidenced this cycle. Read full brief · 1100 words ###### Latest update · 4 November 2026 #### Regulatory Status Sri Lanka's data protection regime has acquired a confirmed commencement date for the first time since the Personal Data Protection Act, No. 9 of 2022 was enacted. Extraordinary Gazette No. 2498/16, dated 22 July 2026, sets 1 January 2027 as the date Sections 2 and 3, Part I and Part III come into operation, covering lawful processing and controller/processor obligations respectively. The Data Protection Authority of Sri Lanka has issued Circular No. 01/2026, superseding its September 2024 circular, to prepare public-sector bodies for Part III's obligations. Set against this progress, Part VII, which contains the administrative penalty regime, is understood to have been excluded from the July 2026 commencement order, meaning the Act's substantive duties will take effect without an active fining mechanism behind them. Separately, the Online Safety Act, No. 9 of 2024 continues to grant the Online Safety Commission broad disclosure-compulsion and content-removal powers that civil-society and international legal submissions say lack judicial-warrant safeguards; the government has stated it will not enforce the Act in its current form pending amendment, though confirmation of any amendment text has not surfaced. #### Outlook The principal forward-looking questions are whether Part VII will be commenced on a separate, later track, and whether the Online Safety Act's contested disclosure and takedown powers will be narrowed by amendment before the data protection regime's substantive obligations take effect on 1 January 2027. 1 earlier update not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Sri Lanka's data-protection regime is in a distinctive transitional state: the Data Protection Authority, established under the Personal Data Protection Act in August 2023, appointed its first permanent Director General in March 2026, while the Personal Data Protection (Amendment) Act, No. 22 of 2025 removed the PDPA's grace-period commencement mechanism, leaving the Act's substantive Parts -- controller/processor duties, data-subject rights, cross-border-transfer rules, and enforcement powers -- to commence only upon a future Ministerial Gazette Order, not yet published as of June 2026. No formal adequacy decisions have been issued, and sector-specific statutes, including the Banking Act No. 30 of 1988, remain among the only operative sources of data-handling obligations in their sectors in the interim. The PDPA itself is GDPR-modelled in its lawful-processing and data-subject-rights structure, meaning the eventual substantive regime, once commenced, will resemble EU-style data protection in content even though Sri Lanka sits entirely outside the EU adequacy and AMLA-style supranational-supervision architecture relevant to other monitors. #### Outlook Publication of the Ministerial Gazette Order commencing the PDPA's substantive Parts is the single event most likely to change Sri Lanka's data-protection status materially. Until then, institutional capacity-building continues without a corresponding activation of substantive controller, data-subject-rights, or enforcement provisions. Read full brief · 465 words Key regulatory facts for Sri Lanka Regulatory Dimension Sri Lanka Standing Position Jurisdiction Sri Lanka (LK) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 73 sourced findings) Regulator & Framework Comprehensive omnibus statute enacted and regulator operational, but core substantive Parts (I, II, III, VII) have had commencement dates repeatedly postponed and several implementing regulations remain in... Lawful Processing & Special Data Core lawful-basis and special-category provisions exist in the Act text, but they sit in Parts (I-III) whose commencement date has been repeatedly postponed, and pseudonymisation/anonymisation rules were not located. Data Subject Rights Rights exist in principle under the Act, but implementing regulations governing procedure/deadlines were still in public-consultation draft form as of late 2024, and core Parts covering these rights had postponed... Controller/Processor Duties Substantive duties are set out in the Act, but a cluster of implementing regulations were still in draft/consultation stage as of the last confirmed update, and the DPO obligation itself was narrowed by the pending... Primary Instruments Cited DataGuidance, DataGuidance, Neelakandan & Neelakandan, Data Protection Authority of Sri Lanka, Ada Derana Last Confirmed / Updated 2026-11-04 (27 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Sri Lanka: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Comprehensive omnibus statute enacted and regulator operational, but core substantive Parts (I, II, III, VII) have had commencement dates repeatedly postponed and several implementing regulations remain in draft/consultation. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber Comprehensive omnibus statute enacted and regulator operational, but core substantive Parts (I, II, III, VII) have had commencement dates repeatedly postponed and several implementing regulations remain in draft/consultation. #### Sub-modules (5) #### Regulator And AuthorityGreen The Authority was established under Part V of the PDPA, which entered into force on 17 July 2023. Claims (4): - Part V of the PDPA entered into force on 17 July 2023, thereby establishing the Data Protection Authority of Sri Lanka. - Data Protection Authority of Sri Lanka — Under the PDPA in August 2023; appointed its first permanent Director General in March 2026 - Data Protection Authority of Sri Lanka — established and operational under Part V of the PDPA, in force from 17 July 2023 - The DPA was established under the PDPA and has been operational since August 2023. #### Act And InstrumentsAmber PDPA No. 9 of 2022 was enacted/endorsed on 19 March 2022 and commences in phases via ministerial Order, with an October 2025 amendment further adjusting timelines and substantive provisions. Claims (9): - The Personal Data Protection Act, No. 9 of 2022 was passed by the Parliament of Sri Lanka and endorsed on 19 March 2022. - Parts VI, VIII, IX and X of the PDPA entered into effect on 1 December 2023, with Parts I, II, III and VII scheduled to enter into effect on 18 March 2025 per a January 2024 commencement Order. - Sri Lanka's Parliament adopted amendments to the PDPA on 21 October 2025, which postponed operational dates, clarified automated-decision-making rights, limited DPO requirements, and introduced more flexible cross-border data transfer mechanisms. - A Gazette Extraordinary of 22 July 2026 sets 1 January 2027 as the commencement date for PDPA Sections 2-3, Part I and Part III. - A Gazette Order sets 1 January 2027 as the commencement date for core PDPA processing and controller/processor provisions. - Gazette Extraordinary No. 2498/16 — appoints 1 January 2027 as the date Section 2, Section 3, Part I and Part III of the PDPA come into operation; Part II and Part VII are not named and remain pending - Personal Data Protection (Amendment) Act, No. 22 of 2025 — The original grace-period provisions for operationalisation, meaning remaining substantive Parts commence only on a future Ministerial Gazette Order - Personal Data Protection (Amendment) Act, No. 22 of 2025 — substituted section 1(3) of the principal Act, removing fixed commencement deadlines and allowing the President to appoint commencement dates for remaining provisions by Gazette Order - The Data Protection Authority of Sri Lanka was established under Part V of the PDPA, in force from 17 July 2023. #### Material ScopeGreen The PDPA applies to processing of personal data generally but excludes purely personal/domestic/household processing. Claims (1): - The PDPA does not apply to personal data processed purely for personal, domestic, or household purposes by an individual, or to data other than personal data (Section 2(3)). #### Territorial ScopeGreen The PDPA has extraterritorial reach, applying to controllers/processors outside Sri Lanka who offer goods/services to, or monitor the behaviour of, data subjects in Sri Lanka. Claims (4): - The PDPA applies extraterritorially to processing that offers goods or services to data subjects in Sri Lanka (including targeted offerings) or that monitors the behaviour of data subjects in Sri Lanka, including profiling (Section 2(2)). - PDPA Section 2(1) — extends application to entities with no Sri Lankan establishment that offer goods or services to, or monitor the behaviour (including profiling) of, data subjects in Sri Lanka, commencing 1 January 2027 - Personal Data Protection Act, No. 9 of 2022 — Applies to processing within Sri Lanka and extends extraterritorially to controllers/processors outside Sri Lanka offering goods/services to, or monitoring the behaviour of, individuals in Sri Lanka. - The PDPA's territorial extent is described as worldwide, reaching controllers/processors offering goods or services to, or monitoring, individuals in Sri Lanka. #### Regulator Registration And FilingRed No general controller/processor registration or filing regime with the Authority was identified in available sources; the closest analogue is the DPO-communication duty and the data-protection-management-programme obligation, which are treated under controller_processor_duties. Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) is the first comprehensive data-protection statute in the jurisdiction, establishing the Data Protection Authority of Sri Lanka. Commencement has been staggered by ministerial Order across 2023-2025, and a further October 2025 amendment postponed several operational dates and adjusted DPO/ADM/cross-border provisions, so the regime is best characterised as in transition rather than fully in force. Periodic update · new data 2026-11-04 #### Regulator & Framework Sri Lanka's data protection framework has reached a defined turning point. Extraordinary Gazette No. 2498/16, dated 22 July 2026, confirms 1 January 2027 as the date on which Sections 2 and 3, Part I and Part III of the Personal Data Protection Act, No. 9 of 2022 come into operation. This is a confirmed commencement, not a proposal, and it replaces what had previously been an open-ended wait for an order to be issued at all. The same order appears to exclude Part VII, which houses the administrative penalty regime; current reporting indicates that the enforcement-by-fine mechanism will not be implemented alongside the 1 January 2027 commencement date, though the precise statutory penalty figures and the possibility of a future separate commencement for that Part have not been independently confirmed against a primary gazette text. #### Outlook The period leading up to the commencement date is likely to surface further implementation detail, particularly on whether Part VII is activated by a later, separate order. Until that happens, the Act's substantive provisions will apply without the administrative fining mechanism that was originally built into the statute. 4 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework The institutional architecture of Sri Lanka's data protection regime has been in place since 17 July 2023, when the Data Protection Authority was established under Part V of the Personal Data Protection Act, No. 9 of 2022, per Gazette Extraordinary No. 2341/59. What has changed is not the existence of the Authority but the operative scope of the law it administers. A Gazette Extraordinary of 22 July 2026 fixes 1 January 2027 as the date on which Sections 2 and 3, Part I (Processing of Personal Data) and Part III (Controllers and Processors) come into operation. Until this order, the Act's substantive processing rules and the duties placed on controllers and processors had not been activated; the Authority existed, but the law it was built to administer in its central operative sense did not yet bind the market. This is the most material development in the jurisdiction's data protection framework in some time, moving the Act from an institution-building phase into an implementation phase on a known date. The territorial reach of the Act is described, in secondary material, as worldwide in effect, extending to controllers and processors who offer goods or services to, or monitor, individuals in Sri Lanka, regardless of where those controllers or processors are established. This extraterritorial framing, if it holds as drafted, would place offshore businesses serving the Sri Lankan market within scope of the regime once Parts I and III take effect, a point that merits attention from organisations outside Sri Lanka whose services nonetheless reach individuals there. The precise statutory provision establishing this test was not independently verified against the Act's own text, and the claim should be read as reported rather than as a confirmed pinpoint citation. Ahead of the January 2027 date, the Authority has begun a preparatory guidance programme, directing public authorities toward governance arrangements, data protection officer appointments and readiness assessments. A joint readiness session with the National Chamber of Commerce of Sri Lanka, scheduled for 28 October 2026 and featuring the Authority's Director General, indicates the regulator is now engaging directly with industry and civil-society stakeholders as the commencement date approaches, rather than confining its communications to the public sector alone. What remains unresolved structurally is the staggered nature of the Act's commencement. Parts I and III are now dated; Part II, carrying data subject rights, is not. A regime that activates controller and processor obligations before activating the rights those obligations are meant to serve is an unusual sequencing choice, and it is one regulators and affected organisations alike will need to navigate through the first year of operation. #### Outlook Between now and 1 January 2027, expect the Authority to expand its guidance programme beyond the public sector, likely issuing sector-specific or general readiness circulars addressed to private controllers and processors as the operative date nears. The territorial-scope question, specifically whether the extraterritorial test will be applied against offshore entities serving the Sri Lankan market, is likely to draw clarifying guidance or early enforcement signalling once Part III is in force. Whether a commencement order for Part II follows promptly, or lags well behind Parts I and III, will determine whether the asymmetry between binding duties and enforceable rights is a brief transitional feature or a more durable structural gap in the regime as implemented. Periodic update · new data 2026-10-18 #### Regulator & Framework Sri Lanka's data protection framework reached a significant milestone with an Extraordinary Gazette Order issued by the President on 22 July 2026, appointing 1 January 2027 as the commencement date for Sections 2 and 3, Part I (Processing of Personal Data) and Part III (Controllers and Processors) of the Personal Data Protection Act, No. 9 of 2022. Prior to this Order, the remaining parts of the PDPA were understood to come into operation only on a date the responsible Minister would appoint, with no fixed timeline. The Order replaces that open-ended uncertainty with a specific date just over two months away from this writing. The Data Protection Authority of Sri Lanka, the regulator established under the Act, has been operational since August 2023, with Part V (which establishes the Authority itself) in force from 17 July 2023. The Authority therefore already exists and has institutional standing, even though the substantive processing and controller/processor obligations it will oversee are not yet binding. This sequencing, regulator first, substantive duties later, means the DPA has had over three years of institutional existence ahead of the obligations its core mandate concerns becoming enforceable. The practical effect of the Gazette Order is to convert the PDPA from a statute whose substantive core was indefinitely deferred into one with a concrete, near-term commencement date for the processing-of-personal-data provisions (Part I) and the duties imposed on controllers and processors (Part III). Part II, covering data subject rights, remains without a commencement date, meaning that from 1 January 2027, organisations will owe processing and controller/processor duties under a regime in which the rights those duties are meant to protect are not yet themselves in force. #### Outlook The period between now and 1 January 2027 is the operative implementation window for any organisation subject to the PDPA. The absence of a commencement date for Part II (data subject rights) is the clearest open question for this module going forward: a data protection framework in which controller obligations are binding but subject rights are not creates an asymmetric compliance landscape that organisations should track as further Gazette Orders, if any, are issued. Periodic update · new data 2026-10-11 #### Regulator & Framework The Personal Data Protection Act, No. 9 of 2022 has, as at 22 July 2026 dated reporting, acquired its first confirmed substantive commencement date since certification. Gazette Extraordinary No. 2498/16 appoints 1 January 2027 as the date Section 2, Section 3, Part I and Part III of the Act come into operation. This follows a period in which an earlier commencement target — 18 March 2025, for Parts I, II, III and VII together — was repealed by Gazette No. 2427/34, dated 14 March 2025. That repeal left those four Parts without any confirmed implementation date for more than a year, a gap the new Order now partially closes. The partial nature of the 2026 Order is the central framework fact for this module. It names Section 2, Section 3, Part I and Part III. It does not name Part II (data subject rights) or Part VII (enforcement and penalties) among the provisions brought into operation. Whether those two Parts commence by some separate or associated mechanism not captured in the commentary reviewed, or whether they remain pending beyond 1 January 2027, is not resolved in the sources available. This is a gap in what has been confirmed, not a finding that those Parts are excluded. Separately from the commencement question, the Act's general framework includes an extraterritorial application test: it applies to processing within Sri Lanka and extends to controllers and processors located outside Sri Lanka that offer goods or services to, or monitor the behaviour of, individuals in Sri Lanka. That test sits in the Act's general provisions rather than within a Part specifically confirmed by the 2026 Order, so the practical operative status of extraterritorial reach follows whatever provisions the Order actually brings into force. The overall trajectory for this module is escalating: after a multi-year pattern of delay and at least one outright repeal of a prior commencement target, the Act now has a dated, named set of provisions due to take effect on 1 January 2027, even though the full scope of that effect remains to be confirmed against the primary Gazette text. #### Outlook The near-term question is whether the Data Protection Authority or a further Gazette notice clarifies the status of Part II and Part VII ahead of 1 January 2027. Confirmation either way would resolve a material open question: a regime that imposes controller and processor duties without a correspondingly confirmed individual-rights framework or penalty regime is a materially different proposition than one in which all three commence together. Until that clarification appears, the framework's described status as at 1 January 2027 should be read as covering the confirmed provisions only. Periodic update · new data 2026-10-05 #### Regulator & Framework Sri Lanka's Personal Data Protection Authority, established and operational under Part V of the Personal Data Protection Act since that Part came into force on 17 July 2023, now sits alongside a significantly clarified commencement timeline for the remainder of the principal Act. The clarification traces to the Personal Data Protection (Amendment) Act, No. 22 of 2025, which substituted section 1(3) of the principal Act. That substitution removed the fixed commencement deadlines the original Act had carried and replaced them with a mechanism allowing the President to appoint commencement dates for the Act's remaining provisions by Gazette Order, on a rolling basis, as each becomes ready for implementation. The first exercise of that mechanism is Gazette Extraordinary No. 2498/16, which appoints 1 January 2027 as the date on which Section 2, Section 3, Part I and Part III of the Act come into operation. This is a material development because it converts what had been an open architecture, a framework capable of commencing but without any specific date attached to most of its substantive provisions, into a dated obligation for a defined set of provisions. Part I carries the Act's lawful-processing and special-category-data rules; Part III carries controller and processor duties, including the Section 12 requirement that every controller implement a documented Data Protection Management Programme of internal controls. Section 2(1) is a particularly consequential inclusion: it extends the Act's application to entities with no establishment in Sri Lanka that nonetheless offer goods or services to, or monitor the behaviour, including profiling, of, data subjects located in Sri Lanka. That extraterritorial reach now has a fixed effective date, where previously its activation depended on an unscheduled future Gazette. The commencement order is equally informative in what it omits. Part II, which carries the Act's data-subject-rights provisions, is not named in Gazette 2498/16, and nor is Part VII, which carries the Authority's enforcement powers, including the capacity to impose administrative penalties of up to LKR 10 million per instance of non-compliance, doubling on repetition. The practical consequence is a regime that, from 1 January 2027, will impose extraterritorial-scope obligations and controller/processor duties on covered entities without the data-subject-rights provisions that would let individuals exercise corresponding entitlements, and without the administrative-penalty mechanism that would give the Authority its primary enforcement lever over those same obligations. This is not a drafting oversight so much as the structural consequence of the amendment's own design: the President may commence provisions individually as they become ready, and Parts II and VII evidently were not assessed as ready at the time Gazette 2498/16 was issued. The Authority itself has been operational since 2023 under Part V, which governs its establishment and institutional structure, together with whatever mandate Parts VI, VIII, IX and X confer; what rules, if any, the Authority has issued under that standing mandate in the period since establishment has not been resolved in the material available this cycle. The Authority's institutional existence and the commencement of the extraterritorial-scope and controller-duty provisions are therefore two separate facts: the regulator has existed and operated for over three years, while the substantive obligations it will eventually supervise most broadly are only now receiving a confirmed effective date, and not yet a complete one. #### Outlook The clearest open question for this module is whether a further commencement order will name Part II and Part VII ahead of, on, or after 1 January 2027, and whether any such order will arrive with enough lead time for covered entities to align data-subject-rights processes and anticipate administrative-penalty exposure before those provisions take effect. Until such an order issues, the practical posture for any entity assessing Sri Lankan exposure is that extraterritorial-scope and controller/processor obligations will bind from 1 January 2027 as scheduled, while the corresponding rights and enforcement architecture remain in the undated status the 2025 amendment created and has not yet resolved. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (18) - [DataGuidance](https://www.dataguidance.com/jurisdiction/sri-lanka) — Part V of the PDPA entered into force on 17 July 2023, thereby establishing the Data Protection Authority of Sri Lanka. - [DataGuidance](https://www.dataguidance.com/jurisdiction/sri-lanka) — The Personal Data Protection Act, No. 9 of 2022 was passed by the Parliament of Sri Lanka and endorsed on 19 March 2022. - [DataGuidance](https://www.dataguidance.com/jurisdiction/sri-lanka) — Parts VI, VIII, IX and X of the PDPA entered into effect on 1 December 2023, with Parts I, II, III and VII scheduled to enter into effect on 18 March 2025 per a January 2024 commencement Order. - [DataGuidance](https://www.dataguidance.com/jurisdiction/sri-lanka) — Sri Lanka's Parliament adopted amendments to the PDPA on 21 October 2025, which postponed operational dates, clarified automated-decision-making rights, limited DPO requirements, and introduced more flexible cross-border data transfer mechanisms. - [DataGuidance](https://www.dataguidance.com/opinion/sri-lanka-personal-data-protection-act-overview-part) — The PDPA does not apply to personal data processed purely for personal, domestic, or household purposes by an individual, or to data other than personal data (Section 2(3)). - [DataGuidance](https://www.dataguidance.com/opinion/sri-lanka-personal-data-protection-act-overview-part) — The PDPA applies extraterritorially to processing that offers goods or services to data subjects in Sri Lanka (including targeted offerings) or that monitors the behaviour of data subjects in Sri Lanka, including profiling (Section 2(2)). - [Neelakandan & Neelakandan](https://neelakandan.lk/insights/data-protection-in-transition-understanding-sri-lankas-new-legal-framework) — A Gazette Extraordinary of 22 July 2026 sets 1 January 2027 as the commencement date for PDPA Sections 2-3, Part I and Part III. - [Data Protection Authority of Sri Lanka](https://www.dpa.gov.lk/) — A Gazette Order sets 1 January 2027 as the commencement date for core PDPA processing and controller/processor provisions. - [Ada Derana](https://adaderana.lk/news/cmsjsp2vt0005356q4pjfv4ih) — Gazette Extraordinary No. 2498/16 — appoints 1 January 2027 as the date Section 2, Section 3, Part I and Part III of the PDPA come into operation; Part II and Part VII are not named and remain pending - [Data Protection Authority of Sri Lanka](https://www.dpa.gov.lk/) — Data Protection Authority of Sri Lanka — Under the PDPA in August 2023; appointed its first permanent Director General in March 2026 - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=law&c=LK) — Personal Data Protection (Amendment) Act, No. 22 of 2025 — The original grace-period provisions for operationalisation, meaning remaining substantive Parts commence only on a future Ministerial Gazette Order - [Concentric AI](https://concentric.ai/sri-lankas-pdpa-takes-effect-january-1-2027-what-global-enterprises-need-to-know/) — Data Protection Authority of Sri Lanka — established and operational under Part V of the PDPA, in force from 17 July 2023 - [Neelakandan & Neelakandan](https://neelakandan.lk/insights/data-protection-in-transition-understanding-sri-lankas-new-legal-framework) — Personal Data Protection (Amendment) Act, No. 22 of 2025 — substituted section 1(3) of the principal Act, removing fixed commencement deadlines and allowing the President to appoint commencement dates for remaining provisions by Gazette Order - [Ada Derana](https://adaderana.lk/news/cmsjsp2vt0005356q4pjfv4ih) — PDPA Section 2(1) — extends application to entities with no Sri Lankan establishment that offer goods or services to, or monitor the behaviour (including profiling) of, data subjects in Sri Lanka, commencing 1 January 2027 - [Wikipedia](https://en.wikipedia.org/wiki/Information_privacy_law) — Personal Data Protection Act, No. 9 of 2022 — Applies to processing within Sri Lanka and extends extraterritorially to controllers/processors outside Sri Lanka offering goods/services to, or monitoring the behaviour of, individuals in Sri Lanka. - [https://www.dpa.gov.lk/](https://www.dpa.gov.lk/) — The DPA was established under the PDPA and has been operational since August 2023. - [Concentric AI](https://concentric.ai/sri-lankas-pdpa-takes-effect-january-1-2027-what-global-enterprises-need-to-know/) — The Data Protection Authority of Sri Lanka was established under Part V of the PDPA, in force from 17 July 2023. - [Wikipedia](https://en.wikipedia.org/wiki/Information_privacy_law) — The PDPA's territorial extent is described as worldwide, reaching controllers/processors offering goods or services to, or monitoring, individuals in Sri Lanka. ### Sri Lanka: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category provisions exist in the Act text, but they sit in Parts (I-III) whose commencement date has been repeatedly postponed, and pseudonymisation/anonymisation rules were not located. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) — Schedules I, II, III Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber Core lawful-basis and special-category provisions exist in the Act text, but they sit in Parts (I-III) whose commencement date has been repeatedly postponed, and pseudonymisation/anonymisation rules were not located. D2 · Lawful Processing — Full Module Record 4 sub-modules · 42 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Rights exist in principle under the Act, but implementing regulations governing procedure/deadlines were still in public-consultation draft form as of late 2024, and core Parts covering these rights had postponed commencement. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber Rights exist in principle under the Act, but implementing regulations governing procedure/deadlines were still in public-consultation draft form as of late 2024, and core Parts covering these rights had postponed commencement. #### Sub-modules (5) #### Access RightAmber The Authority sought public input on draft fee regulations for data-subject-rights requests, implying an access/rights-request mechanism is being operationalised, but the underlying statutory access-request procedure text was not retrieved. Claims (2): - The Data Protection Authority of Sri Lanka sought public input on draft fee regulations for data-subject-rights requests under the PDPA. - Part II of the PDPA (data subject rights) remains without an announced commencement date. #### Rectification And ErasureRed General strengthening of data-subject rights is stated as a Section 1/PDPA objective; specific rectification/erasure mechanics were not located. #### Restriction And ObjectionRed No specific restriction-of-processing or objection-right provision text was retrieved in available sources. #### Data PortabilityRed No specific data-portability provision was identified in available sources. #### Deadlines And Response WindowsAmber The Authority ran a 2024 consultation on draft regulations for data-subject rights and appeals, and separately on fee regulations for rights requests, indicating response-window mechanics were still being finalised via secondary legislation as of the survey window. Claims (2): - The Authority sought public input on draft regulations for data subjects' rights and appeals under the PDPA, extending the feedback deadline to 15 November 2024. - PDPA Part II — Part II, covering data-subject rights, is not named in the 22 July 2026 commencement Order and has no confirmed effective date The PDPA is described as strengthening data-subject rights, and the Authority has run consultations on draft regulations for DSAR rights and appeals and fee schedules for rights requests, but concrete statutory deadlines and detailed mechanics for access, rectification, erasure, restriction, objection and portability were not located in available secondary sources — much of this remains in draft-regulation form. Sources and claims (4) - [DataGuidance](https://www.dataguidance.com/jurisdiction/sri-lanka) — The Data Protection Authority of Sri Lanka sought public input on draft fee regulations for data-subject-rights requests under the PDPA. - [DataGuidance](https://www.dataguidance.com/jurisdiction/sri-lanka) — The Authority sought public input on draft regulations for data subjects' rights and appeals under the PDPA, extending the feedback deadline to 15 November 2024. - [Ada Derana](https://adaderana.lk/news/cmsjsp2vt0005356q4pjfv4ih) — PDPA Part II — Part II, covering data-subject rights, is not named in the 22 July 2026 commencement Order and has no confirmed effective date - [HashtagCoders](https://hashtagcoders.lk/blogs/data-privacy-laws-sri-lanka-2026) — Part II of the PDPA (data subject rights) remains without an announced commencement date. ### Sri Lanka: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Substantive duties are set out in the Act, but a cluster of implementing regulations were still in draft/consultation stage as of the last confirmed update, and the DPO obligation itself was narrowed by the pending 2025 amendment. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber Substantive duties are set out in the Act, but a cluster of implementing regulations were still in draft/consultation stage as of the last confirmed update, and the DPO obligation itself was narrowed by the pending 2025 amendment. Periodic update · new data 2026-11-04 #### Controller/Processor Duties Part III of the Personal Data Protection Act, No. 9 of 2022, which carries controller and processor obligations, is confirmed to commence on 1 January 2027 under Extraordinary Gazette No. 2498/16. In preparation for that date, the Data Protection Authority of Sri Lanka has issued Personal Data Protection Circular No. 01/2026, which replaces the Authority's earlier Circular No. 01/2024 issued 13 September 2024, to provide implementation guidance to public-sector bodies ahead of Part III taking effect. The circular is guidance rather than binding law, but its issuance indicates the regulator is actively working to ready public bodies for the obligations that will apply from the commencement date, even though no legal penalty regime will be active alongside those obligations at that point given the exclusion of Part VII. #### Outlook Whether equivalent implementation guidance will be extended to private-sector controllers and processors ahead of 1 January 2027, and how compliance will be monitored in the absence of an active penalty mechanism, are the two questions most likely to define this area over the coming months. Periodic update · new data 2026-10-25 #### Controller/Processor Duties Part III of the Personal Data Protection Act, which sets out the duties placed on controllers and processors, is now dated to commence on 1 January 2027, per the Gazette Extraordinary of 22 July 2026. This is the second limb, alongside Part I's processing rules, brought into operation by the same commencement order, and it is the limb most directly relevant to how organisations structure their internal data governance ahead of the operative date. The Data Protection Authority has moved ahead of the commencement date itself to issue preparatory guidance. Circular No. 01/2026 is understood to direct public authorities to establish governance arrangements, appoint data protection officers where required, implement Data Protection Management Programmes, and conduct audits, gap assessments and data protection impact assessments in advance of the Part III commencement date. This circular is addressed, at least in its current form, to public authorities specifically, rather than to the private sector broadly, though the substantive content, DPO appointment, DPMPs, audits and impact assessments, mirrors the kind of accountability architecture that private-sector controllers and processors operating in Sri Lanka will also need to build before January 2027 if they fall within the Act's scope. The sequencing here is notable: the regulator is using the window between the commencement order and its effective date to drive readiness activity, rather than waiting for the law to take effect before engaging with obliged entities. The 28 October 2026 industry readiness session, co-hosted with the National Chamber of Commerce of Sri Lanka and featuring the Authority's Director General and senior directors, is a further and more public-facing extension of this same readiness push, this time reaching beyond the public sector into the wider business community. What is not yet confirmed is the full scope of controller and processor obligations as they will read once Part III is operative, beyond the governance, DPO, DPMP, audit and impact-assessment elements already signalled through the Circular. Organisations should treat the Circular's content as an indicator of regulatory expectation and direction rather than as the complete and final statement of Part III's requirements. #### Outlook Expect the Data Protection Authority's guidance programme to extend from the public sector into private-sector controllers and processors as 1 January 2027 approaches, likely with sector-specific variants given the readiness session's industry co-sponsorship. The accountability architecture already signalled, governance structures, DPO appointment, DPMPs, audits, gap assessments and impact assessments, is a reasonable basis for controllers and processors to begin internal readiness work now, ahead of further detail that may follow from the regulator before the commencement date. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Controller and processor duties under Part III of the Personal Data Protection Act, No. 9 of 2022 now have a confirmed commencement date of 1 January 2027, set by an Extraordinary Gazette Order issued by the President on 22 July 2026. This is the first time these duties have had anything other than an open-ended, Minister-appointed commencement date, and it gives regulated entities a fixed implementation deadline for the first time since the Act's original 2022 enactment. Ahead of that date, the Data Protection Authority of Sri Lanka issued Personal Data Protection Circular No. 01/2026 on 8 August 2026, replacing the earlier Circular No. 01/2024. This circular provides transition-period implementation guidance, directing entities, including public authorities, to begin preparatory steps such as data protection impact assessments and internal audits ahead of Part III's commencement. The circular itself is not a binding legal instrument; it is preparatory guidance from the regulator rather than a source of enforceable obligation, and its content should be read as indicating the DPA's expectations rather than a legal requirement in its own right until Part III itself takes effect. The combination of a fixed commencement date and an active transition circular indicates that the DPA is treating the run-up to 1 January 2027 as an implementation period rather than a continuation of indefinite deferral. For controllers and processors operating in Sri Lanka, this is the first concrete signal that compliance preparation, rather than continued monitoring of commencement uncertainty, is now the operative posture. #### Outlook The period to 1 January 2027 is the window in which controllers and processors should expect further DPA guidance consistent with Circular No. 01/2026's transition-period framing. Whether additional circulars or implementing regulations will follow before the commencement date, and whether enforcement mechanisms under Part VII will be scheduled in parallel, remain open questions this cycle's evidence does not resolve. D4 · Controller & Processor — Full Module Record 7 sub-modules · 61 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A transfer-mechanism framework exists in the Act, but implementing directives were in draft/consultation form and no adequacy decisions to or from Sri Lanka were identified. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber A transfer-mechanism framework exists in the Act, but implementing directives were in draft/consultation form and no adequacy decisions to or from Sri Lanka were identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 74 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ General cross-sector coordination is committed to in policy statements, but dedicated sectoral overlay statutes/regulations for financial services, health, employment, credit, education, or insurance were not located. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber General cross-sector coordination is committed to in policy statements, but dedicated sectoral overlay statutes/regulations for financial services, health, employment, credit, education, or insurance were not located. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 63 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct marketing is explicitly addressed by statute; other adtech-adjacent sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) have no located statutory or DPA-guidance basis. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA), Part IV Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber Direct marketing is explicitly addressed by statute; other adtech-adjacent sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) have no located statutory or DPA-guidance basis. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 31 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ ADM and profiling are addressed at a scope/definitional level and via a reported 2025 amendment, but dedicated biometric, genetic-data, and AI-risk-assessment regimes were not confirmed as enacted. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber ADM and profiling are addressed at a scope/definitional level and via a reported 2025 amendment, but dedicated biometric, genetic-data, and AI-risk-assessment regimes were not confirmed as enacted. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance The Online Safety Act, No. 9 of 2024 remains the central friction point for surveillance-adjacent governance in Sri Lanka. The Online Safety Commission established under the Act holds broad powers to compel disclosure of information and to direct the removal of online content. Civil-society organisations and international legal submissions have argued that these powers compromise digital privacy because they operate without judicial-warrant safeguards of the kind typically attached to compulsory-disclosure powers elsewhere. The government is understood to have stated that it will not enforce the Act in its current form pending amendment, which suggests an acknowledged tension between the Act as drafted and privacy protections, but whether amendment text has actually been tabled or passed in the legislature has not been confirmed as at this writing. #### Outlook The Act's powers remain formally in force regardless of the stated non-enforcement posture, so any shift from policy-level restraint to actual legislative amendment would be the development most likely to resolve the current tension between the Commission's disclosure powers and privacy safeguards. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 65 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ Targeted searches for children/minors provisions in the PDPA and DPA guidance returned no relevant results. Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Not assessed Targeted searches for children/minors provisions in the PDPA and DPA guidance returned no relevant results. #### Sub-modules (5) #### Age VerificationRed No age-of-consent or age-verification provision was identified. #### Parental ConsentRed No parental-consent mechanism analogous to COPPA or GDPR Art 8 was identified. #### Minor Profiling BansRed No minor-specific profiling ban was identified. #### Education SettingsRed No education-setting-specific data-protection rule was identified. #### Dependent AdultsRed No dependent-adult-specific protection was identified. No PDPA provision or Authority guidance addressing age of consent, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections was located in available sources. ### Sri Lanka: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement powers exist on the statute's face, but no confirmed enforcement decisions/fines were located, and the underlying substantive obligations remain subject to a shifting commencement timetable. Primary framework Personal Data Protection Act, No. 9 of 2022 (PDPA) Supervisory authority Data Protection Authority of Sri Lanka Traffic-light rationale — Amber Enforcement powers exist on the statute's face, but no confirmed enforcement decisions/fines were located, and the underlying substantive obligations remain subject to a shifting commencement timetable. Periodic update · new data 2026-11-04 #### Enforcement & Redress The clearest enforcement-relevant development this period is what the July 2026 commencement order leaves out rather than what it brings in. Extraordinary Gazette No. 2498/16 confirms 1 January 2027 as the commencement date for Parts I and III of the Personal Data Protection Act, No. 9 of 2022, but Part VII, which contains the administrative penalty regime, does not appear among the Parts brought into operation. This means that from the commencement date, the Act's substantive processing and controller/processor obligations will apply without the fining mechanism originally built into the statute to enforce them. The precise penalty figures as drafted in Part VII, and whether any indication exists of a future separate commencement for that Part, have not been independently confirmed against a primary gazette text. #### Outlook Whether Part VII is activated on a delayed track of its own is the single most consequential open question for how much practical force the regime carries once its substantive provisions take effect on 1 January 2027. Periodic update · new data 2026-10-25 #### Enforcement & Redress The enforcement architecture under Sri Lanka's Personal Data Protection Act remains, for the moment, a reported rather than fully confirmed structure. A penalty-escalation rule is understood to apply to repeated non-compliance, under which a subsequent breach may attract a penalty of twice the amount previously imposed for an earlier instance of non-compliance. This is an escalating rather than a flat per-breach penalty model, which if confirmed against the Act's primary text would create a meaningful deterrent effect for organisations with a prior compliance history under the Act. The base penalty tiers, the precise statutory provision establishing the escalation, and the Part under which this enforcement mechanism sits were not independently confirmed, and the claim should be treated as reported pending verification. No enforcement action, investigation, or redress mechanism activation has been identified for Sri Lanka within the window, which is unsurprising given that the Act's core processing and controller and processor duties, Parts I and III, do not themselves become operative until 1 January 2027. Enforcement activity of the kind the penalty-escalation rule contemplates cannot meaningfully begin until the underlying obligations it attaches to are themselves in force. What has occurred instead is preparatory and readiness-building activity ahead of that enforcement capability becoming live. The Data Protection Authority and the National Chamber of Commerce of Sri Lanka are holding a readiness session, "PDPA 2027: From Law to Practice," on 28 October 2026, with the Authority's Director General and senior directors in attendance. Sessions of this kind, run by the regulator itself in partnership with a leading industry body, are a visible signal that the Authority is positioning itself to move into an active enforcement posture once the January 2027 commencement date is reached, rather than treating enforcement capability as a matter to be built only after the law takes effect. No cross-border criminal-justice data-sharing arrangement specific to Sri Lanka, such as a mutual legal assistance arrangement or an accession to an international cybercrime-cooperation instrument, was identified. This remains an open question for the jurisdiction's redress and cross-border enforcement cooperation posture. #### Outlook The period before 1 January 2027 is best read as the Authority's run-up to an enforcement capability that does not yet have a live legal basis to act against Part I or Part III breaches. Expect further detail on the penalty structure, including base tiers and the governing provision, to surface as the commencement date nears and as readiness sessions such as the 28 October 2026 event generate more granular regulator commentary. Confirmation or otherwise of a cross-border data-sharing or mutual-assistance arrangement remains an open item to track. Periodic update · new data 2026-10-18 #### Enforcement & Redress Enforcement and redress under the Personal Data Protection Act, No. 9 of 2022 remains the module furthest behind the Act's substantive progress. While an Extraordinary Gazette Order of 22 July 2026 fixed 1 January 2027 as the commencement date for Part I (processing) and Part III (controller/processor duties), Part VII, which contains the Act's penalty provisions, has not received a commencement date and remains pre-commencement. Secondary commentary states that the PDPA defines penalties of up to LKR 10 million per violation, but this figure sits within Part VII and has not been independently confirmed at pinpoint level against the Act's own text; the finding rests on a single T3 secondary source rather than a located primary provision. Until Part VII is brought into force, and until its specific penalty provisions are confirmed against primary text, the practical enforcement exposure facing a controller or processor that breaches its Part III duties from 1 January 2027 onward remains legally undefined. The Data Protection Authority of Sri Lanka has been operational since August 2023 and has demonstrated regulatory activity through its issuance of Circular No. 01/2026 on 8 August 2026, providing transition guidance ahead of commencement. This shows an active regulator notwithstanding the absence of a commenced enforcement regime, but a circular of this kind carries no penalty or sanctioning power in itself. #### Outlook The central gap to track is whether and when Part VII will receive its own commencement date. Until it does, the Act's core processing and controller/processor duties will take effect on 1 January 2027 without a confirmed, legally binding penalty regime standing behind them, a structural gap between substantive obligation and enforceable consequence that organisations assessing compliance risk in Sri Lanka should treat as a live and unresolved question. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 91 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (35 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties