Digital age: Sri Lanka's security and data privacy

Organised first ever data privacy and protection summit

- 

Ing yet essential stepping stones for any organisation under Sri Lanka’s Personal Data Protection Act (PDPA), asserted Brandix Director Oshada Sennanayake. “We went through this journey a couple of years ago, and we are still in the middle of it,” he shared, stressing that compliance is not a onetime task but an ongoing process.

“It’s a journey. It’s not a one-size-fits-all approach,” the Director noted, urging businesses to design systems that align with their specific operations and risks.

Under Section 12 of the PDPA, all organisations are required to implement a DPMP-a comprehensive set of policies, practices, and procedures to ensure legal compliance and uphold key privacy principles. But as he warned, “Just having something in place like a policy document is not going to be sufficient. It has to be a live thing that is operational.”

He added that regulators will scrutinise not only the existence of policies but also their practical efficacy and efficiency, particularly in the event of a breach.

Executive buy-in and cross-functional collaboration