Prez urged to withdraw Personal Data Protection Act (A) Bill, consult relevant stakeholders

A group of non-governmental organisations and their linked individuals have urged President Anura Kumara Dissanayakaye to withdraw the Personal Data Protection Act (amendment) Bill (Data Protection Act No 09 of 2022) that was gazetted in March 2025. They have requested President Dissanayake to consult relevant stakeholders and experts on key amendments to be made.

- 

The following is the text of the letter dated May 5, 2025 addressed to President Dissanayake: We write to you in your capacity as the Minister of Digital Economy regarding the proposed amendment to the Personal Data Protection Act, No. 9 of 2022, which was placed on the gazette on 27 March 2025.

It is noteworthy that Sri Lanka is leading by example in South Asia as the first country to enact digital privacy legislation for the protection of its citizens. However, we would like to bring to your attention that the enactment of the Personal Data Protection Act (PDPA) in 2022 was met with criticism by media associations, civil society and members of the opposition, including members of your own party, due to its inability to fulfil the stated aim of safeguarding digital privacy. Regrettably, the proposed amendments to the PDPA do not rectify the concerns raised in 2022.

A crucial shortcoming of the Act is the power of the President to appoint members to lead the Data Protection Authority (DPA). The appointment process is not independent and hence does not guarantee that the DPA will function without political interference by successive governments. In this context, there is risk of the DPA being deliberately under-resourced or the staff lacking subject-domain expertise, which will adversely impact its ability to conduct investigations, develop robust guidelines, handle complaints efficiently, or effectively supervise complex data processing activities, especially when related to AI.