Getting your AI systems ready for Sri Lanka's PDPA by 1 January 2027

On 1 January 2027 the core of Sri Lanka’s Personal Data Protection Act starts to apply. For an organisation using AI, that date brings real duties on notice, impact assessment, vendors and data transfers. This guide sets out what changes, in the order most organisations will want to do the work. The Act itself is covered on the framework page, and the automated decision rule on the section 18 page.

What commences and what waits

The Act was certified in 2022, but only Part V, which set up the Data Protection Authority, came into force straight away. An order for the main parts on 18 March 2025 was withdrawn while Parliament amended the Act. The Personal Data Protection (Amendment) Act No. 22 of 2025 then let the Minister bring the Act in by stages.

Gazette No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I on processing personal data and Part III on controllers and processors. Part II, which holds the data subject rights including the review of automated decisions, and Part VII on penalties, need a further order. The Authority has said it will only investigate complaints and hear appeals once the relevant provisions are in force. That gives organisations a window to build the record before the rights can be exercised against them.

Start with an inventory of AI that touches personal data

Every duty below depends on knowing which systems process personal data and what they do with it. The Data Protection Management Programme in section 12 asks for catalogued records that show how each processing obligation is met. For AI, that means a register of each system and agent with its owner, its purpose, the personal data it uses, whether it profiles people, whether it decides anything about them on its own, and which vendor runs it.

Include the AI built into software you already use, not only the systems you built. A shadow AI search usually turns up assistants, plug-ins and vendor features nobody recorded. The AI system register guide sets out the fields worth capturing.

Tell people about automated decisions and their logic

Section 11 requires controllers to give people the information in Schedule V when they collect personal data. Item (m) asks for the existence of automated individual decision-making, including profiling, with reasonably meaningful information about the logic involved and the significance and envisaged consequences for the person.

For each system on the register that decides or profiles, write a short plain description of what it does, what data it relies on, how the result is reached in general terms and what it means for the person. Generic statements that “we may use automated tools” do not tell anyone about the logic. Keep the wording tied to the register so a new or changed system prompts a notice update.

Run an impact assessment before profiling

Section 24 requires a personal data protection impact assessment before any processing that involves a systematic and extensive evaluation of personal data, including profiling, or systematic monitoring of publicly accessible areas or telecommunication networks. The assessment must look at the effect on the controller’s Part I obligations and the rights of data subjects under Part II, and record the measures taken to reduce the risk of harm. A Data Protection Officer must help where one is required.

The Authority has published draft regulations on the form and manner of these assessments. Until they are final, an AI impact assessment that describes the system, identifies who it affects, weighs the harm and records the controls covers the substance. Section 24(4) requires a fresh assessment whenever the methodology, technology or process changes, so a model swap or a new data source should trigger one. The Authority can ask to see any assessment.

Put AI vendors under written contracts

Most AI vendors processing personal data for you are processors. Section 21 requires you to use only processors that provide appropriate technical and organisational measures, under a contract or law that sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the controller’s obligations. Section 22 requires processors to act only on your written instructions, support your audits and return or erase data at the end. A vendor that decides the purposes and means for itself is treated as a controller.

Check what each AI contract says about training on your data, model changes, sub-processors and incident notice. The vendor AI risk guide covers the due-diligence questions.

Settle how data sent abroad is protected

Many AI services process data outside Sri Lanka. The amended section 26 allows cross-border data flows where the controller or processor complies with Parts I and II and sections 20 to 25, and adopts instruments the Authority specifies by directive to secure binding and enforceable commitments from the recipient. The Authority’s draft directive recognises instruments such as contractual clauses, codes of conduct, certifications and transfer impact assessments. Explicit informed consent, contract necessity and a few other grounds remain available. The Minister can also bar public authorities from transferring categories of data the Minister prescribes.

Public authorities

The Authority’s Circular No. 01/2026 of 7 August 2026 asks ministries, departments, provincial councils, local authorities, public corporations and state-owned enterprises to start now. It covers governance arrangements, Data Protection Officers, a Data Protection Management Programme, personal data audits, impact assessments and staff awareness. Ministries and government departments must appoint a Data Protection Officer and publish their contact details. Public corporations may need one under the core activities test in section 20(1)(b).

A note on this guide

This is Aicura’s reading of the PDPA as amended, the commencement order and the Authority’s circular. It is not legal advice. Read the primary sources on the Data Protection Authority’s site and take advice on how they apply to you.