Sri Lanka was South Asia’s first country to pass a comprehensive data protection law. After delays and a 2025 amendment, a July 2026 gazette brought the core processing principles and controller and processor obligations into force from 1 January 2027.
The Data Protection Authority already exists and is issuing guidance. Some parts, including data subject rights and penalties, depend on further commencement orders.
- Core data law
- Personal Data Protection Act No. 9 of 2022 (amended 2025)
- Regulator
- Data Protection Authority of Sri Lanka
- Core duties from
- 1 Jan 2027
- Extraterritorial?
- Yes, for goods or services offered to people in Sri Lanka
- Pending
- Rights and penalty parts await commencement orders
- Penalties
- Up to LKR 10 million per violation once in force
Who needs to comply
Startups processing personal data in Sri Lanka or targeting people there
The Act applies to processing in Sri Lanka and to offshore controllers offering goods or services to, or monitoring, people in Sri Lanka.
The laws, in detail
01Personal Data Protection Act
Lawful processing, purpose limitation, minimisation, accuracy, retention, security and transparency; controller and processor duties.
When it applies
Processing in Sri Lanka, or offshore processing targeting or monitoring people there.
What you must do
- Lawful basis and transparency
- Data protection officer where required
- Security and breach management
- Data protection impact assessments for high-risk processing
- Cross-border transfer conditions
Regulator
Data Protection Authority
Penalties
Administrative penalties up to LKR 10 million per violation, once the penalty provisions commence.
02Online Safety Act 2024
Prohibited online statements and duties of internet intermediaries, overseen by an Online Safety Commission.
When it applies
Online platforms and intermediaries accessible in Sri Lanka.
What you must do
- Comply with Online Safety Commission notices to remove prohibited statements
- Maintain complaint mechanisms
- Cooperate with information requests
Regulator
Online Safety Commission
Penalties
Fines and imprisonment for specified offences; orders against platforms.
03Computer Crime Act 2007 & Electronic Transactions Act 2006
Computer offences, electronic contracts and electronic signatures.
When it applies
Businesses operating computer systems or contracting electronically in Sri Lanka.
What you must do
- Use valid e-contracts and e-signatures
- Cooperate with investigations
Regulator
Police; ICTA
Penalties
Fines and imprisonment.
04Central Bank payments and fintech rules
Licensing of payment service providers and payment cards and mobile payment operators.
When it applies
Payments and fintech businesses operating in Sri Lanka.
What you must do
- Central Bank licence or registration
- Security and consumer protection rules
- Foreign exchange compliance
Regulator
Central Bank of Sri Lanka
Penalties
Licence action and penalties.
Compliance checklist
01 · Before 1 Jan 2027
- Map processing of Sri Lankan data
- Appoint a DPO if required
- Update notices and contracts
02 · From 2027
- DPIAs for high-risk processing
- Transfer safeguards
- Track further commencement orders
Key dates
- Mar 2022PDPA enacted
- 17 Jul 2023Data Protection Authority established
- 2025Amendment Act No. 22 of 2025
- 1 Jan 2027Core duties commence
Common mistakes
- Assuming the law never commenced
- Waiting for every part to commence before starting work
FAQs
When does Sri Lanka’s PDPA apply?
Core processing principles and controller/processor duties from 1 January 2027; other parts by later gazette.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.