Importance of data protection for organisations in Sri Lanka

IN an increasingly digital world where data has become one of the most valuable assets, the need to protect personal and sensitive information is more important than ever. This leads to the question, as Sri Lanka attempts to strengthen its data protection policies, are we truly ready?

- By M. Dimuthu Suranjana

Global lessons: Looking to Europe and Australia

The European Union set a benchmark with the General Data Protection Regulation (GDPR) in 2018. The GDPR changed how personal data is handled in the EU by giving people more control over how their data is collected and used, and by introducing strict penalties for companies that do not follow the rules.

Similarly, Australia introduced the Privacy Act of 1988, which has since evolved to address contemporary data privacy concerns, particularly with regard to consent, data breaches, and cross-border data flows. These frameworks underscore the importance of long-term commitment, clear regulatory enforcement, and public awareness.

The Sri Lankan context

In 2022, Sri Lanka introduced its own Personal Data Protection Act (PDPA) — a commendable and necessary step. This Act aligns with international norms and seeks to establish a legal framework to govern the collection, processing, storage, and dissemination of personal data. This applies to any processing of personal data within Sri Lanka and by entities offering goods/services to, or monitoring the behaviour of, individuals in Sri Lanka, and excludes personal/domestic data use by individuals and data that is not personal in nature. This legislation aims to ensure that citizens and consumers can trust that their personal data is processed lawfully, fairly, and responsibly.

However, despite the legislative development, concerns remain about implementation readiness. Is our public sector equipped to safeguard citizen data? Are private companies — particularly Small and Medium-sized Enterprises (SMEs) — aware of their obligations? Is the general public informed of their data rights? More research needs to be done on Sri Lankan organisations to identify their readiness on this.

Importance of data protection