Sri Lanka Personal Data Protection Act No. 9 of 2022, as amended in 2025

What it is

The Personal Data Protection Act No. 9 of 2022, the PDPA, is Sri Lanka’s first comprehensive data protection law. It was certified on 19 March 2022 and amended by the Personal Data Protection (Amendment) Act No. 22 of 2025, certified on 30 October 2025. The Data Protection Authority of Sri Lanka administers it.

The Act does not mention artificial intelligence. It regulates the processing of personal data, which is defined broadly enough to cover collecting, storing, retrieving and carrying out logical or arithmetical operations on it. Training, fine-tuning and running an AI system on personal data are all processing, and the Act’s rules on profiling and automated processing reach AI directly.

Who it applies to

Section 2 applies the Act to processing that takes place wholly or partly in Sri Lanka. It also applies to processing by a controller or processor that is domiciled, ordinarily resident, incorporated or established in Sri Lanka, that offers goods or services to data subjects in Sri Lanka, or that specifically monitors the behaviour of data subjects in Sri Lanka, including profiling them with the intention of making decisions about them.

A controller decides the purposes and means of processing, alone or jointly. A processor acts for a controller. Public authorities are controllers too, and the 2025 amendment redefines a public authority as a ministry, department, provincial council or local authority, excluding public corporations and companies.

What it requires

The obligations that matter most for AI sit in Parts I and III, which apply from 1 January 2027.

• Lawful, purposeful processing. Sections 5 to 10 require a lawful basis from the Schedules, specified and legitimate purposes, data that is adequate, relevant and proportionate, accuracy, limited retention, and integrity and confidentiality.
• Transparency. Section 11 requires controllers to give data subjects the information in Schedule V. Item (m) of that Schedule covers the existence of automated individual decision-making, including profiling, with reasonably meaningful information about the logic involved and the significance and envisaged consequences for the person.
• Accountability. Section 12 requires a Data Protection Management Programme, a set of internal controls and catalogued records that show how the processing obligations are met, built into governance and backed by internal oversight.
• Data Protection Officer. Section 20 requires a Data Protection Officer for ministries and government departments, and for controllers and processors whose core activities involve regular and systematic monitoring at scale, special categories of data at scale, or categories of risky processing the Authority sets out in guidelines. The amendment allows the role to be filled by a third party.
• Processors. Sections 21 and 22 require controllers to use processors with appropriate technical and organisational measures under a written contract, and processors to act only on written instructions.
• Impact assessments. Section 24 requires a personal data protection impact assessment before processing that involves a systematic and extensive evaluation of personal data, including profiling, systematic monitoring of publicly accessible areas or telecommunication networks, or other processing the Authority names by rules. A fresh assessment is needed whenever the methodology, technology or process changes, and the Authority can call for it.
• Breach notification. Section 23 requires controllers to notify the Authority of personal data breaches in the form and time set by rules, which the Authority has published in draft.
• Cross-border data flows. The amended section 26 allows transfers abroad where the controller or processor complies with the Act and adopts instruments the Authority specifies by directive.

Part II gives data subjects rights of access, withdrawal of consent and objection, rectification, erasure and review of solely automated decisions. These rights, and the penalties in Part VII of up to ten million rupees for each failure to follow a directive, need a further commencement order.

Key dates

• 19 March 2022. The Act certified.
• 17 July 2023. Part V in force, establishing the Data Protection Authority.
• 14 March 2025. The order that had set 18 March 2025 for the main parts was withdrawn ahead of the amendment.
• 30 October 2025. Amendment Act No. 22 of 2025 certified.
• 22 July 2026. Gazette No. 2498/16 appoints 1 January 2027 for sections 2 and 3, Part I and Part III.
• 7 August 2026. The Authority’s Circular No. 01/2026 asks public authorities to prepare, including by appointing Data Protection Officers and carrying out impact assessments where needed.
• 1 January 2027. Processing obligations and controller and processor duties in force.

How it relates to other frameworks

The PDPA follows the structure of the GDPR closely, with similar lawful bases, a notice requirement that includes the logic of automated decisions, impact assessments for profiling and a Data Protection Officer role. Its automated decision rule in section 18 gives a right to request review rather than a general prohibition. Like India’s DPDP Act, it is coming into force in stages.

Sri Lanka has no AI-specific law. The Cabinet approved implementation of a national AI strategy in August 2024, and the Ministry of Digital Economy sought public comments on the national AI policy in early 2025. Until AI rules follow, organisations using AI in Sri Lanka often pair the PDPA with ISO/IEC 42001 or the NIST AI RMF to structure their AI risk and impact work.

A note on this page

This is Aicura’s reading of the PDPA as amended and the published commencement orders. It is not legal advice and it is not the Act itself. Read the Act, the amendment and the Gazette notices published by the Data Protection Authority, and take advice on how they apply to your organisation.