PDPA obligations Sri Lanka: the duties that start on 1 January 2027

Last verified against the primary sources on 21 October 2026.

PDPA obligations in Sri Lanka begin on 1 January 2027 for Part I (processing of personal data) and Part III (controllers and processors) of the Personal Data Protection Act, No. 9 of 2022, together with sections 2 and 3 on who is covered, under Gazette Extraordinary 2498/16 [6]. From that date every controller must have a lawful basis, limit and secure its data, run a Data Protection Management Programme and bind its processors by contract. The rights of data subjects (Part II) and the penalties (Part VII) still have no date.

The Act is being switched on one circuit at a time. Our piece on the PDPA commencement date traces every Order and the 2025 amendment. This piece goes one level down: what each core duty asks of a business from 1 January 2027, and where the Act leaves the detail to rules that do not yet exist.

PDPA obligations in Sri Lanka start with Parts I and III, and nothing else

Gazette 2498/16 of 22 July 2026 appoints "January 01st, 2027 as the date on which the provisions of Section 2, Section 3, Part I (Processing of Personnel Data) and part III (Controllers and Processors) of the aforesaid Act shall come into operation" [6]. It was made under section 1(3) as replaced by the Personal Data Protection (Amendment) Act, No. 22 of 2025, which lets the Minister appoint "such date or dates" by Order [2]. Every "must from 1 January 2027" statement below is about Part I or Part III, and only that.

Who is caught (sections 2 and 3). Section 2(1) applies the Act where processing "takes place wholly or partly within Sri Lanka", or where the controller or processor is domiciled, ordinarily resident or incorporated here, or "offers goods or services to data subjects in Sri Lanka" or monitors their behaviour here [1]. Section 3(1) gives the Act effect "notwithstanding anything to the contrary in any other written law, relating to the protection of personal data", with a proviso for public authorities governed by another written law "in so far as the protection of personal data of data subjects is consistent with this Act" [1]. Every employer is a controller of its staff records, so these duties reach every business with employees.

A note on our earlier posts

Earlier versions of some of our posts gave 18 March 2025 as the date the PDPA was enforced. That date came from paragraph (b) of Gazette 2366/08, which Gazette 2427/34 repealed on 14 March 2025, four days before it would have operated [4] [5]. The Data Protection Authority's own operational dates page still shows the old date [7]. Those posts have been corrected to the dates in this article.

The 36 months is the Authority's deadline to make rules, not your compliance period

Section 52(2) originally said "The Authority shall make first rules under subsection (1), within twenty-four months from the date of coming into operation of the provisions of Part V" [1]. Section 12 of Act No. 22 of 2025 replaced "within twenty-four months" with "within thirty six months" [2]. Counting from 17 July 2023, that is 17 July 2026, on our arithmetic.

This is a duty on the Authority. It is not a grace period for businesses, and it does not move the 1 January 2027 date. The deadline has passed, and on 21 October 2026 the Authority's guidelines page still listed the breach notification rules, the DPO regulations, the impact assessment regulations and the data subject rights regulations as drafts for public consultation dated October 2024 [8]. What happens when a rules deadline passes without rules? The Act does not say. On our reading, the duties in Parts I and III still start, and only the parts of them that wait for rules wait.

Part I sets seven processing duties and a management programme

Section 4: "Every controller shall process personal data in compliance with the obligations specified under this Act" [1]. Then come seven obligations.

1. Lawful basis (s.5). Processing is lawful only if a condition in Schedule I is met, plus Schedule II for special categories, Schedule III where the basis is consent, and Schedule IV for criminal investigations [1]. Consent is one basis of six in Schedule I, not the default. For employers, contract and legal obligation (EPF, ETF, APIT) cover most payroll processing.
2. Purpose (s.6). Data must be processed for "specified", "explicit" and "legitimate" purposes, and "not be further processed in a manner which is incompatible", with a carve-out for archiving, research and statistics [1].
3. Minimisation (s.7). "adequate", "relevant" and "proportionate" to the purpose [1].
4. Accuracy (s.8). "accurate" and "kept up to date", erasing or correcting outdated data "without undue delay" [1].
5. Retention (s.9). Identifiable "only for such period as may be necessary or required", with a proviso for archiving and research [1]. Statutory record periods, such as those for tax and EPF records, are a reason to keep; our guide to EPF and ETF record keeping lists them.
6. Security (s.10). "appropriate technical and organizational measures including encryption, pseudonymisation, anonymisation or access controls" [1].
7. Transparency (s.11). Give data subjects the Schedule V information in writing or electronically, in a "concise, transparent, intelligible" form [1].

Section 12(1) then requires a "Data Protection Management Programme": catalogued records showing how sections 5 to 11 are met, designed on the "structure, scale, volume and sensitivity" of processing, safeguards based on impact assessments, governance integration, oversight, a complaints and breach mechanism, periodic updating, and a way to facilitate the rights in sections 13 to 16 and 18 [1]. Section 3 of the 2025 Act repealed section 12(2), the old power to issue programme guidelines, but section 11 of the same Act inserted a new section 51A under which the Authority "may, from time to time, issue guidelines" including on "the matters relating to the Data Protection Management Programme as specified in section 12" [2]. So programme guidance can still come, under a different section.

The programme must facilitate rights in Part II, which has no date. On our reading that is a duty to be ready, not a way of bringing Part II forward.

Part III adds DPO, processor, breach, impact and cross-border duties

• Data Protection Officer (s.20). Required for processing "by a Ministry or government department", the 2025 Act having removed public corporations from that limb [2], and where core activities involve "regular and systematic monitoring" or special category data "on a scale and magnitude as may be prescribed" [1]. The 2025 Act replaced the third limb with processing "which results in a risk of harm" as determined by Authority guidelines [2]. A DPO may now be "a third party who is not directly employed by a controller or processor" [2]. Until the scale is prescribed, the private sector trigger is open.
• Processors (ss.21, 22). A controller must use processors with "appropriate technical and organizational measures" and bind them by "a contract or provisions of any written law" covering subject-matter, duration, nature, purpose, data types and categories of data subjects [1]. A processor must act "only on the written instructions of the controller" and bind its staff to confidentiality and secrecy [1]. Our note on contracts and NDAs for a tech team covers the staff confidentiality side.
• Breach notification (s.23). A controller "shall notify the Authority ... in such form, manner and within such period of time as may be determined by rules" [1]. No final rules: the duty exists, the timetable does not.
• Impact assessments (s.24). Before "systematic and extensive evaluation" including profiling, or "systematic monitoring of publicly accessible areas", a controller must carry out an assessment "in a form and manner as may be prescribed", and, as amended, submit it "Upon a written request from the Authority" [1] [2]. The prior consultation procedure in section 25(2) to (6) is repealed [2].
• Cross-border flows (s.26, replaced). Allowed where the controller or processor "ensures compliance with the provisions of Part I, Part II and sections 20, 21, 22, 23, 24 and 25", adopting the instruments the Authority specifies by directive under section 33(c), or where an exception in subsection (3) applies, such as explicit informed consent or necessity for a contract with the data subject [2]. The directive itself is still a consultation draft [8].

Rights and penalties are not yet in operation, so plan rather than wait

Take a hypothetical software company whose parcel tracking app holds the names, addresses and phone numbers of a courier firm's customers. From 1 January 2027 it is a processor for that data. It must act only on the courier firm's written instructions and bind its staff to confidentiality (s.22), and the courier firm must have a contract with it (s.21) [1]. It must protect the data (s.10). It does not yet face a statutory one-month deadline for a customer's access request, because that rule is in section 17, in Part II [2]. Employers face the same questions over staff records, and payslips are a common leak point; our guide to payslip format requirements covers how they are issued.

Section 38 lets the Authority impose a penalty of up to "rupees ten million for each non-compliance" where a controller or processor "fails to comply with a directive issued under the provisions of section 35" [1]. Section 35 is in Part V, in operation. Section 38 is in Part VII, which has no date. On our reading, consistent with our commencement piece, no administrative penalty under the PDPA can be imposed on 1 January 2027 unless a further Order appoints a date for Part VII. That is a reason to plan, not a reason to wait: the duties are law from that date, and a directive can still be issued.

Open points

• Dates for Parts II, IV and VII. None appointed [8].
• The DPO scale threshold and the breach notification timetable, both left to rules or regulations still in draft [8].
• Section 26(1) asks for compliance with Part II, which is not in operation. How that condition reads before Part II starts is not settled.
• The effect of a missed section 52(2) deadline. The Act is silent.

What this means for you

1. Treat 1 January 2027 as real for Parts I and III and for nothing else, until a Gazette says otherwise.
2. Map your lawful bases to Schedule I, and stop treating consent as the only route.
3. Build the section 12 programme: records, oversight, complaints and breach handling. The PDPA compliance checklist for employers breaks it into HR and IT tasks. For checks on candidates, see what the PDPA lets employers do in a background check.
4. Paper your processors under sections 21 and 22. If your payroll is outsourced, the provider is your processor; our payroll services page explains how we work with client data.
5. Prepare the Part II process for access and correction requests now, so it is ready on the day.
6. Watch the Gazette for Orders on Parts II, IV and VII and for final rules. Our HR services page sets out the HR compliance support we offer.

Checklist: documents needed

• Data map: what personal data you hold, where, why and for how long (ss.5 to 9)
• Lawful basis record for each processing purpose (s.5, Schedule I)
• Privacy notice with the Schedule V information (s.11)
• Data Protection Management Programme document (s.12(1))
• Signed contract with each processor, and staff confidentiality terms (ss.21, 22)
• Breach log and escalation procedure (s.23)
• Impact assessment for any profiling or systematic monitoring (s.24)
• List of cross-border transfers and the basis for each (s.26)

From 1 January 2027, under Gazette 2498/16: who is covered (ss.2 and 3), the processing duties (Part I) and the controller and processor duties (Part III). Not yet: rights (Part II), solicited messages (Part IV) and penalties (Part VII). The 36 months is the Authority's clock, not yours.

FAQ

What are the PDPA obligations for businesses in Sri Lanka from 1 January 2027?

From 1 January 2027 every controller must meet the Part I duties: a lawful basis, specified purposes, minimal and accurate data, limited retention, security, transparency and a Data Protection Management Programme. Part III adds a DPO where section 20 applies, processor contracts, breach notification to the Authority, impact assessments and cross-border rules [1] [2] [6].

Do businesses have 36 months to comply with the PDPA?

No. The 36 months in section 52(2), as amended by Act No. 22 of 2025, is the Data Protection Authority's deadline to make its first rules, counted from 17 July 2023, when Part V started. It is not a transition period for businesses, and the duties in Parts I and III still start on 1 January 2027 [2] [6].

Must a private company appoint a Data Protection Officer in 2027?

Not automatically. Ministries and government departments must. A private controller or processor needs one only where its core activities involve regular and systematic monitoring or special category data on a scale still to be prescribed, or processing the Authority's guidelines treat as risky. The DPO may be an outside party [1] [2].

Can an employee demand access to their data from 1 January 2027?

They can ask, but the statutory right is in Part II, which has no appointed date. The one-month response rule in section 17, extendable to three months, sits in Part II too. On our reading it does not bind until Part II starts, though building the process now is sensible because section 12 expects you to be ready [2] [6].

What is the penalty for breaching the PDPA in Sri Lanka?

Section 38 allows a penalty of up to Rs 10 million for each failure to comply with a directive issued after a section 35 inquiry, and twice that for repeat failures. Section 38 is in Part VII, which has no appointed date, so on our reading no administrative penalty can be imposed until a further Order brings Part VII in [1].

This article is general information on the law as at 21 October 2026 and is not advice on your specific circumstances.

Talk to us. If you want to talk through how you keep employee and payroll data before 1 January 2027, book a consultation at our contact page.

WinCore Pvt Ltd

References

1. Parliament of Sri Lanka. Personal Data Protection Act, No. 9 of 2022, ss.1 to 12, 20 to 24, 35, 38, 52, Schedules I to V. https://dpa.gov.lk/acts/Data%20Protection%20Act%20SL%20-%20English%20(2).pdf . Primary. Accessed 21 October 2026.
2. Parliament of Sri Lanka. Personal Data Protection (Amendment) Act, No. 22 of 2025 (certified 30 October 2025), ss.2, 3, 4, 7 to 12 and 14. https://dpa.gov.lk/acts/22-2025_E_251104_201549%20(1).pdf . Primary. Accessed 21 October 2026.
3. Minister of Technology. Order under subsection (5) of section 1, Gazette Extraordinary No. 2341/59 (21 July 2023). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2341-59_E_1784565087.pdf . Primary. Accessed 15 October 2026.
4. President and Minister of Technology. Order under subsection (3) of section 1, Gazette Extraordinary No. 2366/08 (8 January 2024), paras (a) and (b). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2366-08_E_1784565618.pdf . Primary. Accessed 21 October 2026.
5. President and Minister of Digital Economy. Order under subsection (3) of section 1, Gazette Extraordinary No. 2427/34 (14 March 2025). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2427-34_E_1784566846.pdf . Primary. Accessed 21 October 2026.
6. President and Minister of Digital Economy. Order under subsection (3) of section 1, Gazette Extraordinary No. 2498/16 (22 July 2026). https://documents.gov.lk/api/content-file-proxy?file=/extra-gazette-content/2498-16_E_1785745588.pdf . Primary. Accessed 21 October 2026.
7. Data Protection Authority of Sri Lanka. Personal Data Protection Act Operational Dates Announced page. https://dpa.gov.lk/est.php . Primary (administrative, out of date). Accessed 21 October 2026.
8. Data Protection Authority of Sri Lanka. Guidelines and Important Information page (Gazettes list and draft rules), and Department of Government Printing Extraordinary Gazettes search, 2022 to 2026 (search run 15 October 2026). https://dpa.gov.lk/guidelines.php . Primary. Accessed 21 October 2026.