PDPA commencement date Sri Lanka: what the Gazettes switch on

Last verified against the primary sources on 21 October 2026.

The PDPA commencement date in Sri Lanka is not one date. Under Gazette Extraordinary 2498/16 of 22 July 2026, sections 2 and 3, Part I (processing of personal data) and Part III (controllers and processors) of the Personal Data Protection Act, No. 9 of 2022 come into operation on 1 January 2027 [6]. Part V (the Data Protection Authority) has operated since 17 July 2023, and Parts VI, VIII, IX and X since 1 December 2023 [3] [4]. Part II (rights of data subjects), Part IV (solicited messages) and Part VII (penalties) have no appointed date.

A statute can be law without being in operation. The PDPA has been law since March 2022, yet most of its duties still bind nobody. To know what it asks of you on a given day, ask two questions in order: has the provision been enacted, and has a Gazette Order brought it into operation? The second question is where much of the published commentary goes wrong.

Think of the PDPA as a building wired on separate circuits. Parliament built every room in 2022. Each commencement Order throws one switch. Some switches have been thrown, one was thrown and then thrown back, and three are still off. This article traces each switch. What a business must actually do once Parts I and III are live is covered in our companion piece on PDPA obligations from 1 January 2027.

Act No. 22 of 2025 removed the fixed windows and left every date to the Minister

There are two Acts and four Orders to read together.

The principal Act is the PDPA, certified on 19 March 2022. Its section 1(2) brought section 1 itself into operation on certification. The rest was left to Ministerial Orders, originally inside fixed windows: most provisions "not earlier than eighteen months and not later than thirty six months" from certification, and Part IV (solicited messages) "not earlier than twenty-four months and not later than forty-eight months" [1].

The Personal Data Protection (Amendment) Act, No. 22 of 2025, certified on 30 October 2025, removed those windows. Its section 2 replaces section 1(3) with: "All other provisions of this Act except this section, shall come into operation on such date or dates as the Minister may appoint, by Order published in the Gazette", and repeals subsections (4) and (5) [2]. The amending Act has no commencement clause of its own (section 1 is the short title only), so under Article 80(1) of the Constitution it became law when the Speaker endorsed his certificate [10].

So there is no longer any statutory outer date for Parts II, IV or VII. Each now waits for an Order.

Four Gazette Orders set the dates, and one of them was withdrawn

The four Orders are:

• Gazette 2341/59 (21 July 2023): Part V, which sets up the Data Protection Authority, from 17 July 2023 [3].
• Gazette 2366/08 (8 January 2024, signed 29 December 2023): paragraph (a) appoints 1 December 2023 for Parts VI, VIII, IX and X; paragraph (b) appointed 18 March 2025 for Parts I, II, III and VII [4].
• Gazette 2427/34 (14 March 2025): amends 2366/08 "by the repeal of paragraph (b) thereof" [5].
• Gazette 2498/16 (22 July 2026, signed 13 July 2026): appoints "January 01st, 2027 as the date on which the provisions of Section 2, Section 3, Part I (Processing of Personnel Data) and part III (Controllers and Processors) of the aforesaid Act shall come into operation" [6]. The word "Personnel" is the Gazette's own; Part I of the Act is headed processing of personal data.

The 18 March 2025 date in paragraph (b) was repealed four days before it would have taken effect [5]. No new date was given in its place until 2498/16, and that Order picked up only Parts I and III, plus sections 2 and 3.

Read the appointed date, not the masthead date

Gazette 2341/59 was signed on 19 July 2023 and published on 21 July 2023, yet it appoints 17 July 2023 for Part V [3]. The Authority's founding provisions were brought into operation two days before the Minister signed the Order. Nothing turns on it now: section 2(2) of Act No. 22 of 2025 deems "anything duly done under Parts V, VI, VIII, IX and X" before the amendment to be valid [2].

The point for a business is narrower. In 2498/16 the appointed date is 1 January 2027, while the Gazette is dated 22 July 2026 and was signed on 13 July 2026 [6]. Only the appointed date counts.

No PDPA commencement date in Sri Lanka yet for Parts II, IV and VII

Statutory dates (Orders in the Gazette). Part V from 17 July 2023. Parts VI, VIII, IX and X from 1 December 2023. Sections 2 and 3, Part I and Part III from 1 January 2027 [3] [4] [6].

Not appointed. Part II (rights of data subjects, sections 13 to 19), Part IV (solicited messages, section 27) and Part VII (penalties, sections 38 to 40). On 15 October 2026 we searched the documents.gov.lk index of Extraordinary Gazettes for "Personal Data" and "Data Protection" for each year from 2023 to 2026; for 2022 it returned no results table at all. Apart from the four Orders, it returned only two staffing instruments: a scheme of recruitment (2445/23) and the Authority's cadre and recruitment rules (2456/43) [11]. On 21 October 2026 the Authority's own Gazettes list still showed only the four Orders [8]. That is an absence, and absence is weak evidence: an index can miss a Gazette, and a Minister can sign one tomorrow.

The Data Protection Authority's own web page still shows the withdrawn date

Administrative statements are not law, and some are out of date. On 21 October 2026 the Authority's page on operational dates still carried the headline "Enforcement Begins on March 18, 2025" and said "the PDPA will be fully operational and enforced, commencing 18th March 2025" [7]. That was overtaken by Gazette 2427/34.

The Authority's Circular No. 01/2026, dated 7 August 2026 and addressed to the public sector, says the new enforcement dates are "expected to be announced soon", although Gazette 2498/16 had been published on 22 July. It adds: "the Data Protection Authority would only investigate complaints, hear appeals, etc., once the relevant governing provisions are brought into operation" [9].

What switches on for businesses on 1 January 2027

Section 2 sets the reach from 1 January 2027. The Act applies where processing "takes place wholly or partly within Sri Lanka", or where it is carried out by a controller or processor that is domiciled or ordinarily resident in Sri Lanka, incorporated under Sri Lankan law, offering goods or services to data subjects in Sri Lanka, or specifically monitoring their behaviour here. It does not apply to processing "purely for personal, domestic or household purposes by an individual" [1].

Part I (sections 4 to 12) and Part III (sections 20 to 26) are the duties that switch on: a lawful basis under Schedule I, purpose, minimisation, accuracy and retention limits, security, transparency, a Data Protection Management Programme, a Data Protection Officer where section 20 applies, processor contracts, breach notification, impact assessments and the cross-border rules in the new section 26 [1] [2]. Our companion piece goes through each duty section by section, and the PDPA compliance checklist for employers turns them into HR and payroll tasks. Payroll records are the largest store of employee data most firms hold; our guide to EPF and ETF record keeping shows what those records contain.

Take a hypothetical payroll bureau that processes salary data for 40 employers. It is a controller for its own staff records and a processor for its customers' salary data, so both Part I and Part III reach it on 1 January 2027. It does not yet face a statutory one-month deadline for an access request, because that rule sits in section 17, in Part II [2]. If you are choosing between running payroll in-house and outsourcing it, our comparison of payroll software and payroll outsourcing covers the data protection terms to agree with a provider.

Two amendments in Act No. 22 of 2025 change who is caught. "Public authority" now means a Ministry, Department, Provincial Council or local authority, and "does not include" a public corporation or a company incorporated under the Companies Act [2]. The mandatory Data Protection Officer rule in section 20(1)(a) was cut back to match, to processing "by a Ministry or government department" [2].

Open point: the rules are still drafts. On 21 October 2026, the Authority's guidelines page listed rules on breach notification, regulations on DPOs, impact assessments, data subject rights and appeals, fees and the section 35 inquiry procedure, and a cross-border directive, all only as drafts for public consultation dated October 2024 [8]. The first rules deadline in section 52(2) moved from 24 to 36 months after Part V began [2], which on our count was 17 July 2026. That is the Authority's deadline to make rules, not a compliance period for businesses. We found no Gazette publishing the breach, DPO or impact assessment rules.

No PDPA penalty can be imposed until Part VII is brought into operation

The figure everyone quotes is "rupees ten million". Section 38(1) reads: "Where a controller or processor fails to comply with a directive issued under the provisions of section 35, the Authority shall ... by notice require such controller or processor to pay a penalty, which shall not exceed a sum of rupees ten million for each non-compliance" [1]. Section 38(2) adds an additional penalty of "twice the amount" for a repeat failure.

So the default that attracts the penalty is not the breach itself. It is ignoring a directive issued after an inquiry under section 35, which sits in Part V and is in operation [1]. Section 38 sits in Part VII, which has no appointed date. On our reading, no administrative penalty can be imposed under the PDPA today, and none will be possible on 1 January 2027 unless a further Order brings Part VII in. Article 13(6) of the Constitution, which bars a penalty "more severe than the penalty in force at the time such offence was committed", points the same way for past conduct, although whether it reaches an administrative penalty of this kind is itself arguable [10].

Can someone complain to the Authority about your company on 2 January 2027? They can write. The Authority's circular says it "would only investigate complaints, hear appeals, etc., once the relevant governing provisions are brought into operation" [9]. The duties in Parts I and III will be in operation; the rights in Part II and the appeal route in section 19 will not, and the section 35 inquiry procedure regulations are still a draft [8]. How far the Authority can run a section 35 inquiry into a Part I failure in that gap is an open point.

Common misreadings of the PDPA dates

• "The PDPA has been enforced since 18 March 2025." Paragraph (b) of 2366/08 was repealed by 2427/34 on 14 March 2025 [5]. The Authority's page still says otherwise [7].
• "Everything starts on 1 January 2027." Only sections 2 and 3, Part I and Part III [6].
• "Act No. 22 of 2025 gave businesses 36 months to comply." Section 12 of that Act changes section 52(2), which is the Authority's deadline to make its first rules [2] [1].
• "A breach carries a Rs 10 million fine." The penalty is for failing to comply with a section 35 directive, and Part VII is not in operation [1].
• "State companies are public authorities." Not after the 2025 amendment [2].

What this means for you

1. Treat 1 January 2027 as the date for Part I and Part III duties, and plan the work now. If you run payroll or HR in-house or through a provider, our HR services and payroll services teams work with this data every month.
2. Do not plan around a statutory complaint, rights or penalty regime starting on that date. None has been appointed.
3. Build the access request and appeal process anyway, so it is ready when Part II is switched on. The one-month window in the new section 17(1) can be extended by two months, to no more than three months from receipt [2].
4. Check the Gazette, not a web page, before relying on any date, and check again in December 2026.

Checklist: documents needed

• Copy of Gazette 2498/16 on file, with the date it was checked
• A note of which Parts are and are not in operation on your review date
• Data map of the personal data you hold and why (for Part I)
• List of processors and the contracts that bind them (for Part III)
• Draft access request and appeal procedure, ready for when Part II starts
• Diary reminder to re-check the Gazette index and the Authority's rules page

The PDPA's duties on processing arrive on 1 January 2027. Its rights, appeals and penalties do not, on the Gazettes published so far. The Authority's own website still shows a date that was withdrawn in March 2025. For what a website must publish, see a website privacy policy under the PDPA.

We have built part of this on an absence: no Order for Parts II, IV and VII. That is why the advice is to check, not to relax. A room without power is still a room. Fit it out now, and watch for the switch.

FAQ

What is the PDPA commencement date in Sri Lanka?

There is no single date. Part V has operated since 17 July 2023 and Parts VI, VIII, IX and X since 1 December 2023. Sections 2 and 3, Part I and Part III start on 1 January 2027 under Gazette 2498/16. Parts II, IV and VII, covering data subject rights, solicited messages and penalties, have no appointed date on the Gazettes published so far [3] [4] [6].

Was the PDPA enforced from 18 March 2025?

No. Gazette 2366/08 had set 18 March 2025 for Parts I, II, III and VII, but Gazette 2427/34 repealed that paragraph on 14 March 2025, four days before it would have operated. The Data Protection Authority's operational dates page still shows the withdrawn date, so do not rely on it [5] [7].

When did the PDPA Amendment Act No. 22 of 2025 take effect?

It took effect on 30 October 2025, the date of the Speaker's certificate. The Act has no commencement clause of its own, so under Article 80(1) of the Constitution it became law on certification. Its section 2 now lets the Minister appoint any date or dates for the remaining Parts, without the old fixed windows [2] [10].

Can a company be fined under the PDPA from 1 January 2027?

Not on the Gazettes published so far. The Rs 10 million penalty in section 38 is for failing to comply with a directive issued after a section 35 inquiry, and section 38 sits in Part VII, which has no appointed date. On our reading, no administrative penalty can be imposed until a further Order brings Part VII into operation [1].

What is the PDPA breach notification deadline?

None is fixed yet. Section 23 requires a controller to notify the Authority of a breach in the form, manner and time set by rules, and the breach notification rules exist only as a draft for consultation dated October 2024. The duty to notify starts with Part III on 1 January 2027, but the timetable waits for final rules [1] [8].

This article is general information on the law as at 21 October 2026 and is not advice on your specific circumstances.

Talk to us. If you would like your payroll and HR data mapped against Parts I and III before 1 January 2027, book a consultation at our contact page.

WinCore Pvt Ltd

References

1. Parliament of Sri Lanka. Personal Data Protection Act, No. 9 of 2022, ss.1, 2, 10 to 12, 20, 21, 23, 35, 38, 52 and 56, Schedule I. https://dpa.gov.lk/acts/Data%20Protection%20Act%20SL%20-%20English%20(2).pdf . Primary. Accessed 21 October 2026.
2. Parliament of Sri Lanka. Personal Data Protection (Amendment) Act, No. 22 of 2025, ss.1 to 4, 7 to 10, 12 and 14. https://dpa.gov.lk/acts/22-2025_E_251104_201549%20(1).pdf . Primary. Accessed 21 October 2026.
3. Minister of Technology. Order under subsection (5) of section 1 of the Personal Data Protection Act, Gazette Extraordinary No. 2341/59 (21 July 2023). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2341-59_E_1784565087.pdf . Primary. Accessed 15 October 2026.
4. President and Minister of Technology. Order under subsection (3) of section 1, Gazette Extraordinary No. 2366/08 (8 January 2024), paras (a) and (b). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2366-08_E_1784565618.pdf . Primary. Accessed 21 October 2026.
5. President and Minister of Digital Economy. Order under subsection (3) of section 1, Gazette Extraordinary No. 2427/34 (14 March 2025). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2427-34_E_1784566846.pdf . Primary. Accessed 21 October 2026.
6. President and Minister of Digital Economy. Order under subsection (3) of section 1, Gazette Extraordinary No. 2498/16 (22 July 2026). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2498-16_E_1785745588.pdf . Primary. Accessed 21 October 2026.
7. Data Protection Authority of Sri Lanka. Personal Data Protection Act Operational Dates Announced page. https://dpa.gov.lk/est.php . Primary (administrative, out of date). Accessed 21 October 2026.
8. Data Protection Authority of Sri Lanka. Guidelines and Important Information page: Acts, Gazettes, Circular 01/2026 and draft rules. https://dpa.gov.lk/guidelines.php . Primary. Accessed 21 October 2026.
9. Data Protection Authority of Sri Lanka. Personal Data Protection Circular No. 01/2026: Application of PDPA in the Public Sector (7 August 2026), paras 1.3 and 2.2. https://dpa.gov.lk/media/DPA_Circular_012026_E.pdf . Primary. Accessed 15 October 2026.
10. Parliament of Sri Lanka. The Constitution of the Democratic Socialist Republic of Sri Lanka (Revised Edition 2023), Articles 13(6) and 80(1). https://www.parliament.lk/files/pdf/constitution.pdf . Primary. Accessed 15 October 2026.
11. Department of Government Printing. Extraordinary Gazettes search, keywords "Personal Data" and "Data Protection", years 2022 to 2026 (no table returned for 2022). https://documents.gov.lk/web/extra_gazettes . Primary. Accessed 15 October 2026.