PDPA readiness check for Sri Lankan employers

Last verified against the primary sources on 15 October 2026.

Take a hypothetical company whose HR manager emails a salary file to the wrong recipient. The file has NIC numbers, bank accounts and salary data for 45 employees, and the business has no documented breach response process.

When the PDPA applies. The Personal Data Protection Act No. 9 of 2022 comes into force in stages. A start date of 18 March 2025 for the main Parts was withdrawn by Gazette Extraordinary 2427/34 of 14 March 2025 [1]. Gazette Extraordinary 2498/16 of 22 July 2026 now appoints 1 January 2027 for Part I (processing of personal data) and Part III (controllers and processors), the core duties [2]. Part V, which set up the Data Protection Authority, has been in operation since 17 July 2023 [3].

What changed in 2025. The Personal Data Protection (Amendment) Act No. 22 of 2025 requires controllers to answer data subject requests within one month, extendable to three months, free of charge, once Part II of the Act (rights of data subjects) is brought into operation, for which no date has been appointed yet, and lets a Data Protection Officer be a third party who is not the controller's own employee [4].

For employers, obligations run in two directions: toward employees whose data is processed through the employment lifecycle, and toward clients whose data is handled in service delivery.

Use this as an implementation guide rather than a one-time form. The goal is a repeatable control system that HR, legal, IT and operations teams can evidence during a review, in place before 1 January 2027.

Data mapping: know what you hold, where it lives, and why

Before any other compliance work, create a documented inventory of personal data processed by the business.

What to map:

• Employee identity data: Recruitment records, HR files, NIC copies.
• Payroll and financial data: Bank account details, salary records, EPF/ETF records.
• Health and biometric data: Medical certificates, leave documentation, attendance biometrics.
• Performance data: Appraisals, disciplinary records, termination correspondence.
• Client contact data: CRM records, service delivery records, invoicing systems.
• Vendor and supplier data: Contractor agreements and payment records.

Minimum documentation per category:

• What data is held.
• Where it is stored (system and access controls).
• Why it is processed (lawful basis).
• How long it is retained.
• Who can access it.
• Whether it is shared with third parties.

Record a lawful basis for each processing activity

Record a lawful basis for each processing activity. For employment data, most routine processing rests on the employment contract or on a legal obligation such as EPF, ETF and APIT. Consent is a weak basis for employer-employee processing because of the imbalance of power.

For client data, service delivery is usually contract-based. Marketing and profiling activities need clear lawful-basis records and, where needed, valid consent.

Privacy notices: employees and clients

Give a clear notice at the point of collection.

For employee notices, include:

• Controller identity and contact details.
• Categories of personal data collected.
• Lawful basis for each purpose.
• Retention periods or criteria.
• Data subject rights.
• Overseas transfer disclosures and safeguards.
• Consent withdrawal process where consent is used.
• Complaint path to the Data Protection Authority.

For clients, the website privacy policy and onboarding documents should match these disclosures and actual processing practice.

Employee data handling: higher-risk categories

Higher-risk employee data categories need tighter controls.

• Sensitive data: Health, biometrics and similar categories need a documented justification.
• Biometric systems: If biometric attendance is used, document the basis and consider an alternative route.
• Workplace monitoring: CCTV and digital monitoring should be disclosed and proportionate.
• Access controls: Payroll, disciplinary and medical records should be role-restricted and periodically reviewed.

Operational checklist:

• Document the basis for biometric processing.
• Review role-based access and the review cadence.
• Confirm CCTV signage and monitoring disclosures.
• Maintain handbook-level policy coverage for monitoring controls.

Where employee onboarding, leave approvals, payroll inputs and retention ownership are still informal, build that control layer first using the labour law guide for employers and the payroll setup checklist for new employers. PDPA controls fail quickly when the employment record and payroll record are managed as separate systems.

Treat the employee-data review as one part of a wider compliance control check, with an owner for each outstanding action.

Third-party data processors: controller-to-processor agreements

If vendors process data on your behalf (payroll providers, HR platforms, cloud tools), you remain the controller. Put processor obligations in a contract.

Each processor agreement should define:

• Subject matter, duration and nature of processing.
• Data categories and data-subject categories.
• Controller instructions and processor constraints.
• Security, confidentiality and sub-processor rules.

Implementation checklist:

• Maintain a live processor register.
• Confirm a signed agreement for each processor.
• Record overseas transfer mechanisms and safeguards. The Amendment Act replaced the cross-border transfer rule in section 26, and transfers must use the instruments the Authority specifies by directive [4].

Data subject rights: responding within the deadline

Data subjects have rights such as access, rectification and erasure. These rights sit in Part II of the Act, which has no commencement date yet. Once Part II is in operation, the controller must reply in writing within one month of receiving the request, and may extend this by up to two more months for stated reasons, telling the data subject before the first month ends. Requests must be dealt with free of charge [4].

To stay response-ready:

• Assign request ownership to a named role or team.
• Map which systems must be searched.
• Prepare response templates.
• Test export and redaction workflows before requests arrive.

Breach management

The Act leaves the manner of notifying a personal data breach to rules made by the Authority. Do not wait for those rules to prepare:

• Name a Data Protection Officer or accountable equivalent; it may be an outside party [4].
• Maintain an incident log template.
• Pre-draft regulator and data-subject notification templates.
• Define the internal escalation and decision flow.
• Link breach playbooks to business continuity procedures.

Retention and secure deletion

Over-retention is a frequent compliance gap. Define, document and enforce retention windows.

Set each period from the rule that actually requires the record: tax records for the IRD, EPF and ETF records, employment law records. Where no rule applies, keep the data only as long as the purpose needs it, and write down why. Short-life data, such as unsuccessful applicant files and routine CCTV footage, should have short, documented periods.

Control checklist:

• Tie retention periods to the data map.
• Run scheduled deletion reviews.
• Verify deletion is irreversible (or archives are strictly access-controlled).

Summary checklist at a glance

A printable version is our PDPA compliance checklist for employers.

1. Complete personal data mapping. Owner: HR and Legal. Due: Immediate.
2. Document lawful basis per processing activity. Owner: Legal. Due: Immediate.
3. Issue updated employee privacy notice. Owner: HR. Due: before 1 January 2027.
4. Update website privacy policy and notices. Owner: Marketing and Legal. Due: before 1 January 2027.
5. Confirm agreements across all processors. Owner: Legal and IT. Due: Within 30 days.
6. Enforce role-based access controls. Owner: IT. Due: Within 30 days.
7. Assign Data Protection Officer accountability. Owner: Board and senior management. Due: Immediate.
8. Finalise breach response playbooks and templates. Owner: Legal. Due: Within 30 days.
9. Document retention and delete overdue records. Owner: HR and IT. Due: Within 60 days.
10. Set up a one-month process for access requests, ready for when Part II comes into operation (no date has been appointed yet). Owner: HR and Legal. Due: before 1 January 2027.

Talk to us. If your HR, IT and payroll records need to be brought into one documented system before 1 January 2027, our HR team can work through the checklist with you; book a consultation at our contact page.

This guide is general information on the law as at 15 October 2026 and is not advice on your specific situation.

PDPA compliance audit Sri Lanka: the ten parts of a readiness check

1. Data map. List every set of personal data you hold, covering staff, drivers, customers, consignees and website users. For each, record where it comes from, where it is stored, who can access it, who it is shared with and whether it leaves Sri Lanka. Section 12(1)(a) requires "duly catalogued records" as part of the management programme [5].

2. Lawful basis. Section 5 says processing "shall be lawful if a controller is in compliance with (a) any condition specified in Schedule I". Schedule I includes:

• consent;
• performance of a contract;
• a legal obligation;
• legitimate interests, "except where such interests are overridden by the interests of the data subject".

Special categories of data need a Schedule II condition [5]. Record the basis for each line of the data map.

3. Notices. Section 11 requires the Schedule V information to be given "in a concise, transparent, intelligible and easily accessible form" [5]. Check your staff notice, customer forms, website and CCTV signs.

4. Consent. Where consent is the basis, check how it is recorded, that it is specific, and how it can be withdrawn. Do not rely on consent where another basis fits better, such as payroll under a legal obligation.

5. Retention. Section 9 requires data to be "kept in a form which permits identification of data subjects only for such period as may be necessary or required for the purposes for which such personal data is processed" [5]. Set a period for each record type, considering tax and employment record-keeping laws, and a deletion routine.

6. Security. Section 10 requires "appropriate technical and organizational measures including encryption, pseudonymisation, anonymisation or access controls" to prevent "(a) unauthorized or unlawful processing of personal data; or (b) loss, destruction or damage of personal data" [5]. Check:

• user access and leavers;
• passwords and multi-factor login;
• backups;
• laptops and phones;
• shared drives.

7. Processors. Section 21(1)(b) requires the controller to ensure each processor "is bound by a contract or provisions of any written law which sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of the data subjects and the obligations of the controller" [5]. This covers payroll bureaus, cloud software, GPS tracking providers and couriers. List them and review the contracts.

8. Data subject requests. Build an intake route, identity checks, a log and a response template. Under Act No. 22 of 2025, the controller must respond "without undue delay and within one month of the receipt of such request" [6]. The period can be extended by up to two more months, to no more than three months from receipt, if the controller tells the person before the first month ends. This is in section 17 (Part II), which is not yet in operation.

9. Breach handling. Section 23(1) states: "In the event of a personal data breach, a controller shall notify the Authority, regarding such personal data breach in such form, manner and within such period of time as may be determined by rules made under this Act" [5]. Those rules are still in draft. Write a response plan now covering who decides, the evidence log and the contact list, so it can be updated once the rules are made.

10. The DPO question. Section 20(1) requires a controller or processor to appoint a Data Protection Officer in set cases. For private businesses, the test is where core activities involve "regular and systematic monitoring of data subjects on a scale and magnitude as may be prescribed", or "processing of special categories of personal data on a scale and magnitude as may be prescribed" [5].

The Act always had a third case, processing that results in a risk of harm to data subjects' rights. Act No. 22 of 2025 replaced it, so that it now covers categories of processing that result in "a risk of harm ... as may be determined by the Authority by way of guidelines" [6]. The scale has not been prescribed, the DPO regulations are still a draft, and on 26 October 2026 the Authority's guidelines page listed no guidelines under this limb. Record your reasoning either way. Since Act No. 22 of 2025, a DPO may also be a third party who is not your employee. You can name a responsible person even where no appointment is required; that is practice, not a legal requirement.

Section 24 also requires a personal data protection impact assessment before any "systematic and extensive evaluation" of personal data, including profiling, any "systematic monitoring of publicly accessible areas or telecommunication networks", or processing that rules made under the Act specify. The assessment regulations are still a draft. Act No. 22 of 2025 replaced the duty to submit every assessment to the Authority with a duty to submit it "Upon a written request from the Authority".

Who can carry out a readiness check

There is no licensed or registered PDPA auditor in Sri Lanka. The Act does not create one. Section 32(j) lets the Authority "recognize certification and certifying bodies in relation to personal data protection", but on 26 October 2026 we found no list of recognised bodies and no accreditation scheme on dpa.gov.lk (home page and Guidelines and Important Information page). The licences in section 34 are for identity management services, not for reviewers. Anyone can offer a "PDPA audit", so judge the person, not the title. Look for:

• Knowledge of the Act as amended: they should know which Parts start on 1 January 2027 and which do not.
• A clear scope: which entities, systems, sites and data sets, and what is excluded.
• Evidence-based work: sampling records and settings, not only interviews.
• A written report: findings ranked by risk, owners and dates, with the legal reference for each point.
• Independence: someone who did not build the systems being tested.
• IT security capability, or a named specialist for section 10.
• Legal input: a lawyer for contracts, cross-border transfers and anything contentious.

An internal review by a capable staff member is a reasonable start for a small firm. Larger or higher-risk processing justifies outside help.

What the Data Protection Authority has published

The DPA's guidelines page lists [7]:

• the Act and Amendment Act No. 22 of 2025;
• the commencement gazettes, including 2498/16;
• "Circular No. 01/2026 - Application of the PDPA in Public Sector - 07th August 2026";
• drafts from October 2024 for public consultation on impact assessments, breach notifications, processing outside Sri Lanka, appointment of the DPO, data subject rights and appeals, the section 35 inquiry procedure and fees.

On 26 October 2026 the page listed no guideline on the Data Protection Management Programme. Act No. 22 of 2025 repealed the old guideline power in section 12(2) and gave the Authority a general power to issue guidelines, including on the programme, in a new section 51A.

As at 26 October 2026, these rules and regulations are drafts. We found no final version in a gazette. Use them as signals of direction, not as binding rules.

Frequently asked questions

When does the PDPA apply to private companies?

Gazette 2498/16 brings sections 2 and 3, Part I (processing) and Part III (controllers and processors) into operation on 1 January 2027. Part II on data subject rights, Part IV on solicited messages and Part VII on penalties need a further order, which we had not found as at 26 October 2026. The Authority has operated since July 2023.

Is there a licensed PDPA auditor in Sri Lanka?

No. The Act does not create a licensed auditor. Section 32(j) lets the Authority recognise certifying bodies, but we found none listed on dpa.gov.lk on 26 October 2026. Anyone can offer a readiness check. Judge the reviewer on their knowledge of the amended Act, a written scope, evidence testing, a risk-ranked report, independence from the systems tested, IT security skill and access to legal advice.

Do we need a Data Protection Officer?

Possibly. Section 20 requires one where core activities involve regular and systematic monitoring, or special category processing, on a scale yet to be prescribed, or where risky categories are set by DPA guidelines. The DPO regulations are still in draft. Record your reasoning, and consider naming a responsible person anyway.

How fast must we report a data breach?

Section 23 requires notice to the Authority in the form, manner and time set by rules under the Act. Those rules were still in draft, from October 2024, as at 26 October 2026. Prepare a breach plan, incident log and decision process now, and update the timing once the final rules are published.

References

1. Government of Sri Lanka. Gazette Extraordinary 2427/34 of 14 March 2025, withdrawing the 18 March 2025 commencement date. https://documents.gov.lk/view/extra-gazettes/2025/3/2427-34_E.pdf . Primary. Accessed 15 October 2026.

1. Government of Sri Lanka. Gazette Extraordinary 2498/16 of 22 July 2026, appointing 1 January 2027 for ss.2 and 3 and Parts I and III. https://documents.gov.lk/view/egz/2026/7/2498-16_E.pdf . Primary. Accessed 15 October 2026.

1. Government of Sri Lanka. Gazette Extraordinary 2341/59 of 21 July 2023, bringing Part V into operation. https://www.documents.gov.lk/view/extra-gazettes/2023/7/2341-59_E.pdf . Primary. Accessed 15 October 2026.

1. Parliament of Sri Lanka. Personal Data Protection (Amendment) Act No. 22 of 2025, ss.4, 8, 10 and 14. https://dpa.gov.lk/acts/22-2025_E_251104_201549.pdf . Primary. Accessed 15 October 2026.

1. Parliament of Sri Lanka. Personal Data Protection Act, No. 9 of 2022, ss.5, 9 to 12, 20, 21, 23, 24, 32, 34, 38, Schedules I and II. https://dpa.gov.lk/acts/Data%20Protection%20Act%20SL%20-%20English%20(2).pdf . Primary. Accessed 25 October 2026.

1. Parliament of Sri Lanka. Personal Data Protection (Amendment) Act, No. 22 of 2025, ss.2 (s.1(3)), 3 (s.12), 4 (s.17), 7 (s.20), 8 (s.24), 11 (s.51A), 14 (s.56). https://documents.gov.lk/api/content-file-proxy?file=/act-content/22-2025_E_1784553020.pdf . Primary. Accessed 26 October 2026.

1. Data Protection Authority. Guidelines and Important Information. https://dpa.gov.lk/guidelines.php . Primary (administrative). Accessed 25 October 2026.