Sri Lanka PDPA compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Sri Lanka's Personal Data Protection Act and what is it used for?

The Personal Data Protection Act, No. 9 of 2022 is Sri Lanka's general law on personal data. It requires processing on a condition the Act lists, for a specified, explicit and legitimate purpose, with accurate data kept only as long as needed. It gives people rights to information, access, withdrawal of consent, correction, erasure and review of automated decisions, and it sets duties for controllers and processors, Data Protection Officers, breach notification, impact assessments and cross-border data flows.

The Data Protection Authority supervises the Act, and the Authority says it reaches processing within Sri Lanka and entities abroad that offer goods or services to, or monitor the behaviour of, people in Sri Lanka. A customer database, an HR file or a contract to process an overseas client's data is enough to bring a business into scope. The practical test: for any personal data you hold, could you show its purpose, who was told, how it is protected and where it goes?

Operating in stages. Part V, creating the Authority, came into operation on 17 July 2023, and Parts VI, VIII, IX and X on 1 December 2023. The Amendment Act, No. 22 of 2025 leaves the other provisions to Orders of the Minister, and Gazette Extraordinary No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I on processing and Part III on controllers and processors; it names no other Part. Confirm any later Order with your counsel.

Who it is for

Who needs to comply with the Sri Lanka PDPA?

The Act applies to controllers and processors whatever their size, including employers holding staff records, and it reaches overseas businesses serving or monitoring people in Sri Lanka. Organisations usually come to Sterling for a structured programme from one of four directions:

• You collect and use personal data in Sri Lanka. Part I sets the processing obligations: a lawful condition, a specified purpose, accuracy, limited retention and security, and it is among the provisions an Order appoints for 1 January 2027.
• You process data for overseas clients. The Act covers processors as well as controllers, and Part III sets processor duties and contract terms that IT, BPM and software exporters will be asked to show.
• You offer goods or services to people in Sri Lanka from abroad. The Authority says the Act applies to entities outside Sri Lanka that offer goods or services to, or monitor the behaviour of, people in Sri Lanka.
• You profile people or monitor them at scale. Systematic and extensive evaluation including profiling, and systematic monitoring of public areas or telecommunication networks, call for an impact assessment before processing begins.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Sri Lanka PDPA requirements?

Strip away the vocabulary and Sri Lanka's Personal Data Protection Act requires a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Act and the regulator's guidance give the full wording and exceptions.

• Processing has a lawful basis and purpose: personal data is processed on a condition the Act lists, for a specified, explicit and legitimate purpose, and only as far as that purpose needs.
• People are informed and can use their rights: data subjects receive the required information in clear form and can ask for access, withdraw consent, correct or erase data, and seek review of automated decisions.
• Data stays accurate and is not over-kept: personal data is kept accurate and up to date, and held in identifiable form only for as long as its purpose requires.
• Data is protected and compliance is recorded: technical and organisational measures protect personal data, and a data protection management programme keeps catalogued records that demonstrate compliance.
• Roles, contracts and breaches are managed: a Data Protection Officer is designated where the Act requires one, processors work under contract, and personal data breaches are notified to the Authority.
• High-risk processing and transfers are assessed: an impact assessment comes before high-risk processing, and cross-border data flows meet the Act's compliance conditions or one of its listed grounds.

Compliance route

How do you achieve Sri Lanka PDPA compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Data Protection Authority if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, suppliers and overseas clients' data subjects: what is collected, on which condition and purpose, where it is stored, who processes it and whether it leaves Sri Lanka.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Settle controller and processor roles, update notices, set retention, put security measures and the data protection management programme in place, designate a Data Protection Officer where required, sign processor contracts and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents, run impact assessments before high-risk processing, review cross-border flows, refresh training and follow the Authority's rules and guidelines as they are finalised.

Check the route before you sign. The Act names no certificate, so treat any offer of a "PDPA certificate" with suspicion. The Authority's powers include recognising certification and certifying bodies, so ask it what it will accept. ISO/IEC 27701 is certifiable by a certification body accredited for it; confirm the body's accreditation directly with the accreditation body concerned.

Cost

How much does Sri Lanka PDPA compliance cost?

The cost of a Sri Lanka PDPA programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Sri Lanka PDPA compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Sri Lanka PDPA engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; the Data Protection Authority supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, retention rules, request, security, impact assessment and breach procedures and processor contract terms, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Data Protection Officer support

  Guidance for the Data Protection Officer or privacy lead on requests, impact assessments, cross-border flows and breach decisions.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Data Protection Authority supervises the Act, and its powers include recognising certification and certifying bodies.

Often combined with

Standards organisations pair with PDPA (Sri Lanka)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.