Sri Lanka's Personal Data Protection Act (PDPA) – Are We Ready?

FOR years, personal data in Sri Lanka moved quietly through businessescustomer profiles, contracts, employee records, and transaction histories-without much public scrutiny.

- 

KBSLs New Leadership Team: (Left to Right) - Aruna Dissanayake (COO), Vasee Nesiah (CEO), Pramukh Jayawardena (CSO)

That era has ended.Sri Lanka became the first South Asian nation to enact comprehensive data protection legislation when the Personal Data Protection Act (PDPA) was signed into law on 19 March 2022. The Data Protection Authority (DPA) was established in August 2023, and core provisions began taking effect from 1 December 2023, and enforcement phased through to 2025 to allow for compliance.

PDPA marks a fundamental shift in how Sri Lankan organizations collect, store, use, and safeguard customer and staff data. Whether a business operates in retail, finance, healthcare, education, or public services, compliance is no longer optional; it is a legal mandate and a reflection of their credibility and integrity. More importantly, it is becoming central to operational resilience and long-term trust.

PDPA arrives at a pivotal time when Sri Lankan organizations are adopting digital tools at unprecedented speed, while expectations around privacy, security, and accountability continue to rise. Government institutions now require adherence to strict data handling standards, and vendors must align operations accordingly. Many enterprises are discovering that legacy systems, fragmented databases, and informal processes that were once sufficient for daytoday operations, now expose significant compliance and security gaps. Global research shows that organizations with structured data governance outperform peers in both operational stability and stakeholder trust, underscoring the value of proactive compliance.