LK-PDPA-9-2022
Personal Data Protection Act No. 9 of 2022, as amended
Data Protection Authority of Sri Lanka
🇱🇰Sri Lanka
Skin
Sri Lanka overview
Sri Lanka's PDPA has staged commencement
The Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025, establishes Sri Lanka's data-protection framework and the Data Protection Authority.
Current commencement position
Earlier commencement orders activated the institutional and enforcement architecture. Extraordinary Gazette No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I on processing, and Part III on controllers and processors. Those core operational duties are therefore future-dated as of this 23 August 2026 review.
Do not mark the whole Act as fully effective yet
Build the programme before 1 January 2027, but label evidence tests for Parts I and III as readiness controls until their appointed commencement date.