Sri Lanka · Compliance
Sri Lanka Personal Data Protection Act (PDPA) compliance in Sri Lanka
Achieve Sri Lanka Personal Data Protection Act (PDPA) compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Mumbai office team
- Effivity software included
- Academy training included
Who asks for Sri Lanka Personal Data Protection Act (PDPA) in Sri Lanka
Clients include
Sri Lanka Personal Data Protection Act (PDPA) compliance in Sri Lanka at a glance
Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Sri Lanka ask for evidence that you meet it.
The Personal Data Protection Act, No. 9 of 2022 is switching on in stages, so the dates matter first. Part V, creating the Data Protection Authority, came into operation on 17 July 2023, and Parts VI, VIII, IX and X on 1 December 2023. The Amendment Act, No. 22 of 2025 leaves the other provisions to Orders of the Minister, and Gazette Extraordinary No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I on processing and Part III on controllers and processors; it names no other Part. The Authority says the Act reaches processing within Sri Lanka and entities abroad that offer goods or services to, or monitor, people in Sri Lanka. No certificate is created and no ISO standard is named, though the Authority may recognise certification and certifying bodies. Sterling's Mumbai office helps organisations map personal data, settle controller and processor roles, prepare records and impact assessments, and build the evidence, with Effivity and Sterling Academy included with the engagement. Sterling does not give legal advice.
Who needs Sri Lanka Personal Data Protection Act (PDPA) in Sri Lanka, and what happens without it
These are the organisations in Sri Lanka that most often need to show Sri Lanka Personal Data Protection Act (PDPA).
- Companies that collect and use personal data in Sri LankaPart I sets the processing obligations: a lawful condition, a specified purpose, accuracy, limited retention and security, and it is among the provisions an Order appoints for 1 January 2027.
- IT, BPM and software exporters processing data for overseas clientsThe Act covers processors as well as controllers, and Part III sets processor duties and contract terms that overseas customers will ask these firms to show.
- Overseas organisations offering goods or services to people in Sri LankaThe Authority says the Act applies to entities outside Sri Lanka that offer goods or services to, or monitor the behaviour of, people in Sri Lanka.
- Ministries, departments and their suppliersA Data Protection Officer is required where processing is carried out by a Ministry or government department, and public authorities face limits on cross-border flows of categories the Minister prescribes.
- Organisations that profile people or monitor them at scaleSystematic and extensive evaluation including profiling, and systematic monitoring of public areas or telecommunication networks, call for an impact assessment before processing begins.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkSri Lanka Personal Data Protection Act (PDPA) requirements in Sri Lanka
Strip away the vocabulary and Sri Lanka's Personal Data Protection Act requires a business to comply in six areas of personal data handling.
In Sri Lanka these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Sri Lanka Personal Data Protection Act (PDPA) explained →
How to achieve Sri Lanka Personal Data Protection Act (PDPA) compliance in Sri Lanka
One team from the Mumbai office carries the work from scoping to sign-off. Clients across Sri Lanka are served from Sterling's Mumbai office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Sri Lanka Personal Data Protection Act (PDPA) and the Sri Lankan requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Sri Lanka Personal Data Protection Act (PDPA) compliance take in Sri Lanka?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Sri Lanka these are the factors that set the timeline.
- Number of systems, files and processing activities to map
- Controller and processor roles across services and suppliers
- Cross-border flows and the instruments the Authority specifies
- Rules and guidelines the Authority has yet to finalise
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Sri Lanka Personal Data Protection Act (PDPA) compliance cost in Sri Lanka?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Sri Lanka these factors move both.
- Number of legal entities and data subject groups in scope
- Volume and sensitivity of the data processed
- Security and record-keeping remediation the gap review calls for
- Training for staff and any Data Protection Officer role
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Sri Lanka Personal Data Protection Act (PDPA) consultants and assessors in Sri Lanka
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Sri Lanka Personal Data Protection Act (PDPA) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Sri Lanka are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Sri Lanka Personal Data Protection Act (PDPA) in Sri Lanka (3)
| Instrument | How it treats the standard |
|---|---|
| Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025) | The instrument itself Supervised by the Data Protection Authority and covering processing obligations, data subject rights, controllers and processors, breach notification, impact assessments and cross-border data flows; it names no ISO standard and creates no certificate. |
| Gazette Orders appointing operation dates | The instrument itself Part V operated from 17 July 2023 and Parts VI, VIII, IX and X from 1 December 2023; Gazette Extraordinary No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I and Part III and names no other Part. |
| Data Protection Authority mandate and guidelines | Regulator's position The Authority regulates processing under the Act, and its powers include recognising certification and certifying bodies in relation to personal data protection. |
Accreditation, audit language and remote audits in Sri Lanka
Compliance, not certification: the Act names no certificate and no ISO standard. Evidence is the data protection management programme records, notices, processor contracts, impact assessments and breach procedure. The Authority's powers include recognising certification and certifying bodies, so ask it what it will accept. ISO/IEC 27701 certification by a certification body accredited for it, or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA), is a voluntary benchmark. Edition and transition details: Sri Lanka Personal Data Protection Act (PDPA) hub →
Audit language
The Act requires information for data subjects in a concise, transparent, intelligible and easily accessible form, so notices should be readable in Sinhala, Tamil or English as the audience needs. The Authority publishes the Act in English; internal records can follow the company's working language.
Remote and on-site
Data-mapping, policy and supplier workshops can run remotely; visits to plants, branches or data rooms are arranged where the scope needs them.
Sri Lanka Personal Data Protection Act (PDPA) in Sri Lanka: questions clients ask
When do Sri Lanka's data protection duties start to apply?
In stages. Part V, the Authority, operated from 17 July 2023, and Parts VI, VIII, IX and X from 1 December 2023. An Order in Gazette Extraordinary No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I and Part III, and names no other Part. Your counsel can confirm any later Order.
Does a company need a Data Protection Officer under the Sri Lankan Act?
Sometimes. A controller or processor designates one where processing is by a Ministry or government department, or where its core activities involve regular and systematic monitoring or special categories of data at a prescribed scale, or processing categories the Authority sets by guidelines. These duties sit in Part III. Counsel can check whether your scale or sector is caught.
Can personal data be sent outside Sri Lanka?
Generally yes, if the Act's conditions are met. As amended in 2025, a controller or processor may engage in cross-border data flows where it complies with the Act's processing, rights and Part III duties, using instruments the Authority specifies, or on listed grounds such as explicit consent after being told the risks. Public authorities face limits on categories the Minister prescribes.
Is there a certificate for Sri Lanka's Personal Data Protection Act?
No. The Act names no certificate and no ISO standard, and compliance is shown through records, notices, processor contracts, impact assessments and breach handling. The Authority's powers include recognising certification and certifying bodies, so ask what it will accept. ISO/IEC 27701 from an accredited certification body remains a voluntary benchmark, and it never replaces the Act.
More on Sri Lanka Personal Data Protection Act (PDPA) for Sri Lankan organisations
Other standards Sri Lankan businesses ask Sterling for
Organisations in Sri Lanka often combine Sri Lanka Personal Data Protection Act (PDPA) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Mumbai office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025) — dpa.gov.lk (accessed 11 Oct 2026)
- Gazette Orders appointing operation dates — dpa.gov.lk (accessed 11 Oct 2026)
- Data Protection Authority mandate and guidelines — dpa.gov.lk (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice