Regulations · Sri Lanka
Understand the Personal Data Protection Act and build the consent, data governance, risk and evidence workflows your organisation needs. See how FaceOff supports each step.
Commencement
The Act has phased commencement. The July 2026 order starts the core processing framework; it does not switch on every part of the law.
Appointed date · 1 January 2027
Sections 2–3, Part I and Part III cover scope, processing principles, accountability, DPOs, suppliers, breaches, impact assessments and cross-border flows.
Read Gazette No. 2498/16 (PDF) →Separate commencement
Parts II, IV and VII are outside this order. The DPA downloads reviewed on 11 October 2026 did not show a later commencement order for them. Build readiness and monitor subsequent orders.
Check the DPA publication register →Rules & guidance
The DPA lists consultation drafts on breaches, DPIAs, DPOs, rights, fees, inquiries and transfers. Check final instruments and the 2025 amendment before adopting a deadline or procedure.
View rules, guidance & drafts →Reviewed . The former 18 March 2025 core commencement was removed by Gazette No. 2427/34; the current appointed date above comes from the July 2026 order.
Scope · Sections 2–3 & 56
Start with where you process data, whose data you handle and your role in deciding how it is used.
The Act covers processing wholly or partly in Sri Lanka and specified controllers and processors domiciled, resident, incorporated or established there, subject to statutory exclusions.
Overseas organisations can be in scope when offering goods or services to, or specifically monitoring the behaviour of, people in Sri Lanka.
Controllers decide purposes and means; processors act on their behalf. Identify special categories, including children's data and biometrics used for unique identification, early in the assessment.
Purely personal, domestic or household processing is excluded, and other statutory exclusions and exemptions need a case-specific review. Section 3 addresses the relationship with other written law. Public-sector teams should also review DPA Circular No. 01/2026 (PDF). Read the Act (PDF) →
Requirements → FaceOff controls
This mapping connects the PDPA's operational requirements to existing FaceOff products. Your team approves the legal interpretation, configures the policies and connects the systems that carry out the work.
Entries marked “Core framework” fall within Parts I or III, appointed for 1 January 2027. Entries marked “Separate commencement” describe readiness for provisions outside that order. Detailed duties can depend on rules, directives and your processing circumstances.
Identify a lawful basis for each activity. Special categories, consent and criminal-investigation processing have additional conditions under the relevant Schedules. Consent is one basis, alongside grounds such as contract, legal obligation and qualifying legitimate interests.
Privacy Program Governance records the basis, purpose and owner of each activity. Consent Management captures permission where consent is the chosen basis.
Evidence to retain: Processing register, basis assessment and consent receipts.
Specify legitimate purposes; collect and reuse only proportionate data for compatible purposes.
Intelligent Data Mapper locates and classifies personal data. Governance connects it to approved purposes; masking reduces exposure in analytics and test environments.
Evidence to retain: Data inventory, purpose map and minimisation decisions.
Keep data accurate and identifiable only as long as necessary, subject to permitted exceptions.
DSAR Management routes corrections to connected systems. Governance manages retention schedules; discovery identifies affected stores and masking supports approved de-identification.
Evidence to retain: Correction history, retention schedule and deletion records.
Apply technical and organisational safeguards appropriate to the processing risks.
Data Anonymization & Masking limits exposure to identifiers. Governance assigns safeguards and Audit & Evidence Management retains proof of implementation alongside your security controls.
Evidence to retain: Safeguard register, access reviews and masking policies.
Give accessible information about processing and make consent specific, informed and freely given.
Consent Management versions notices and records purpose-level choices. Cookie Management discovers trackers and applies configured consent controls to website tags.
Evidence to retain: Notice versions, consent history and tracker inventory.
Maintain a proportionate Data Protection Management Programme with records, oversight, complaints handling and periodic review.
Privacy Program Governance assigns requirements to owners. Audit & Evidence Management links policies, assessments, incidents and remediation to a reviewable control record.
Evidence to retain: Programme register, complaint records and review history.
Designate a DPO where the statutory criteria apply, and publish and communicate their contact details. The amended definition permits a qualifying third party to perform the role.
Governance gives the DPO an overview of processing activities, assigned tasks, risks and evidence; assessment workflows support review and escalation.
Evidence to retain: DPO designation, contact details and oversight actions.
Use suitable processors under binding arrangements, document instructions and protect confidentiality. Address joint-controller responsibilities, subprocessors, audits and data return or erasure.
Governance maintains a processor register linked to activities and contracts. Discovery maps supplier data flows; Audit & Evidence Management retains review and fulfilment records.
Evidence to retain: Supplier register, contracts, instructions and review outcomes.
Prepare to notify the DPA and affected individuals as required by rules. Notification triggers, format and timing depend on the applicable rules.
Data Breach Management coordinates investigation, containment and notification tasks. Discovery helps identify affected data; evidence records the response. Configure Sri Lanka requirements against final rules.
Evidence to retain: Incident timeline, impact assessment and notification log.
Assess qualifying high-risk processing before it starts, mitigate identified harm and reassess material changes. The amended Act requires submission of the assessment on the Authority's written request.
PIA / DPIA Assessment structures screening, risk scoring, mitigations and approval. Governance tracks remediation owners; Audit & Evidence Management retains the assessment history.
Evidence to retain: Approved DPIA, mitigation actions and reassessment history.
Apply the amended transfer conditions and relevant DPA instruments or permitted exceptions. Public authorities face restrictions for categories prescribed under section 26(5).
Intelligent Data Mapper shows data destinations. Governance maintains transfer records and safeguards; Consent Management records explicit transfer consent where that exception is appropriate.
Evidence to retain: Transfer inventory, recipient commitments and exception decisions.
Prepare for access, withdrawal, objections, correction, erasure and appeals, subject to statutory conditions. The amended response period is one month, extendable by two further months with timely notice.
DSAR Management provides intake, identity verification, routing and deadline tracking. Consent Management propagates preference changes; discovery locates records across connected systems.
Evidence to retain: Verified request, response, extension notice and fulfilment trail.
Prepare to review qualifying solely automated decisions with an irreversible and continuous impact on protected rights, subject to exceptions and safeguards.
DSAR Management routes review requests to accountable staff. Assessment workflows document processing risks; Audit & Evidence Management preserves decisions and supporting records.
Evidence to retain: Review request, human decision and documented reasoning.
Prepare consent, sender identification and free opt-out for covered promotional messages.
Consent Management records channel and purpose preferences and distributes withdrawals to connected marketing systems. Audit & Evidence Management retains the preference history.
Evidence to retain: Marketing consent, sender disclosure and suppression records.
Oversight & enforcement
Parts V–VI establish the Authority and its powers, including inquiries and directives. Parts VIII–X address the fund, administration and general provisions. Governance and Audit & Evidence Management help organise policies, decisions and remediation for scrutiny.
Section 38 in Part VII provides for penalties up to LKR 10 million for each failure to comply with a section 35 directive, with additional penalties for repeat non-compliance. Part VII is outside the January 2027 commencement order; distinguish the statutory mechanism from currently operative penalties.
Readiness roadmap
Use a practical sequence that gives each requirement an owner, a working control and evidence of completion.
01
Inventory data, systems, processors and transfers. Confirm scope, lawful bases, special categories and high-risk activities.
02
Approve notices, consent purposes, retention policies and safeguards. Connect the relevant applications and supplier workflows.
03
Confirm DPO requirements and accountable owners. Run a sample rights request, DPIA review and breach-response exercise.
04
Check fulfilment in connected systems, close gaps and retain evidence. Track new DPA instruments and commencement orders.
FaceOff supports execution and evidence. Your organisation approves lawful bases, exemptions, contracts, DPO appointments, risk decisions and regulatory submissions. During a walkthrough, agree Sri Lanka-specific policy configuration, notice languages and integration coverage. Software alone does not establish legal compliance.
Questions
Official sources
This page summarises the principal Act together with the 2025 amendment and the July 2026 commencement order. Full statutory text and DPA publications are linked below.
Principal Act · certified 19 March 2022 · PDF
Amendment · certified 30 October 2025 · PDF
22 July 2026 · core commencement on 1 January 2027 · PDF
Application of the PDPA in the public sector · 7 August 2026 · PDF
Official register · includes Sinhala, Tamil and English editions
Educational overview reviewed on 11 October 2026. Verify subsequent instruments and obtain advice for your processing activities.
Bring a data flow, a consent journey or a supplier process. We will map it to the relevant requirements and show the FaceOff controls and evidence your team can put in place.
