What Is PDPA? Personal Data Protection Act, No. 9 of 2022
Sri Lanka's governing statute is the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025. Part V, establishing the Data Protection Authority, has been in force since 17 July 2023, while Parts VI, VIII, IX, and X have been in force since 1 December 2023. The framework is not fully operative. Part II, which contains data-subject rights, is not currently in force because the March 2025 commencement date was revoked, and Part VII, containing penalties, is also not currently in force. The 22 July 2026 Extraordinary Gazette schedules sections 2-3 and Parts I and III, including territorial-scope and controller/processor provisions, to commence on 1 January 2027. The DPA's older webpage still describes 18 March 2025 as the enforcement date, but that statement is stale and overtaken by the 2025 amendment and later commencement Gazette instruments. The DPA's published inquiry, rights, appeal, and cross-border instruments were identified as drafts, and no final prescribed procedure was located.
At a glance
- Full name
- Personal Data Protection Act, No. 9 of 2022
- Short code
- PDPA
- Jurisdiction
- Sri Lanka
- Enacted
- 2022
- Last major update
- Amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025; the 22 July 2026 Gazette schedules sections 2-3 and Parts I and III for 1 January 2027, while Part II and Part VII still have no current commencement date
- Regulator
- Data Protection Authority
- Private right of action
- Limited
Scope, who PDPA covers
Protected data
Data subject rights
Right of access under section 13, enacted but not currently operative
Right to withdraw consent or object under section 14, enacted but not currently operative
Right to rectification or completion under section 15, enacted but not currently operative
Right to erasure under section 16 for specified unlawful processing, consent withdrawal, or legal or court-ordered grounds, enacted but not currently operative
Right to review certain irreversible or continuously impactful automated decisions under section 18, enacted but not currently operative
Right to appeal a controller refusal to the DPA under amended section 19, enacted but not currently operative; once operative, section 17 as amended requires a written response within one month, extendable for reasons to a maximum of three months with notice before the first month expires
Rights may be exercised through parents, guardians, written representatives, and heirs for 10 years after death
Right to complain to the DPA under the currently operative Part V framework
Notable features
Sri Lanka has an unusually consequential staged-commencement structure. The DPA exists, but its 2026 public-sector circular says it will investigate complaints and hear appeals only once the relevant governing provisions are brought into operation. The principal data-subject rights, penalties, territorial scope, and cross-border-transfer rules are not currently operative. The 2025 amendment also adds a one-month controller response period, a reasoned extension to a maximum of three months, and a right-of-appeal notice requirement once the rights provisions operate. The amended cross-border regime is tied to provisions scheduled for 1 January 2027, and the DPA’s published cross-border instrument remains a draft directive.
Enforcement & penalties
Regulator: Data Protection Authority
Penalties: Section 38 provides a penalty of up to LKR 10 million per non-compliance with a section 35 DPA directive, doubling for repeat non-compliance after a prior penalty. These penalties are enacted but not currently operative because Part VII has not commenced. An appeal against an administrative penalty is stated as 21 working days from communication, but that appeal route likewise concerns the inoperative Part VII framework.
Private right of action: The DPA may issue binding directives requiring cessation, corrective action, or compensation, and section 19(5) provides a 30-day appeal route to the Court of Appeal for a DPA rights determination once Part II is operative. A general private damages action was not located in the report.
Relevance to data brokers
No Sri Lanka-specific data-broker, people-search, or public-record-specific complaint/deletion route was located. The future general framework would require certain indirect-collection controllers to disclose source or public-accessibility status and would provide a general erasure right, but these provisions are not currently operative. Under the 2025 amendment, a controller’s future rights-request response is generally due within one month, with a reasoned extension up to three months and notice of the right to appeal a refusal; the DPA’s current 2026 circular says complaint and appeal handling awaits commencement of the relevant provisions.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Sri Lanka’s data-protection law fully in force?+
No. Part II data-subject rights and Part VII penalties are not currently in force. Part I, Part III, and sections 2-3, including territorial-scope provisions, are scheduled for 1 January 2027.
Can I use Sri Lanka’s data-protection rights?+
The rights in sections 13-19 are enacted but not currently operative. The DPA’s currently operative Part V framework allows inquiries on complaint or otherwise where it has reason to believe a violation occurred.
What response period will apply to Sri Lankan rights requests once operative?+
The 2025 amendment provides for a written controller response within one month, with a reasoned extension of up to two further months, capped at three months from receipt. The controller must notify the data subject of the extension before the initial month expires and explain the right to appeal a refusal. These rights-request provisions are not currently operative.
Is there a dedicated Sri Lankan data-broker deletion route?+
No Sri Lanka-specific data-broker, people-search, or public-record-specific complaint/deletion route was located. The future general erasure and indirect-collection rules are not currently operative.
Official sources & citations
Other international privacy regimes
PDPA sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: