Sri Lanka

Section 2 of the Personal Data Protection Act, No. 9 of 2022 sets out four hooks: processing that happens wholly or partly in Sri Lanka; a controller or processor domiciled or ordinarily resident in Sri Lanka; one incorporated under Sri Lankan law; one that offers goods or services to data subjects in Sri Lanka including specific targeting; and one that specifically monitors their behaviour, including profiling. Extraordinary Gazette No. 2498/16 of 22 July 2026 appoints 1 January 2027 as the commencement date for section 2 and section 3 as well as Part I and Part III. Section 3(1) gives the Act priority over other written laws on data protection. Unlike India or the EU, there is no obligation on a foreign controller to appoint an in-country representative — only a Data Protection Officer where section 20 triggers apply, and that officer may now be an outsourced third party following the 2025 amendment.

This is the single most important thing to understand about Sri Lanka. The original section 26 of the 2022 Act built a European-style adequacy system: the Minister would declare which countries were safe enough, and public authorities had to process inside Sri Lanka unless a declaration covered them. The Personal Data Protection (Amendment) Act, No. 22 of 2025, certified on 30 October 2025, repealed that section outright and replaced it. The new section 26 is a pure accountability model: you may engage in cross-border data flows only where you ensure compliance with Part I, Part II and sections 20 to 25 wherever the data sits, and you must adopt instruments specified by a directive of the Authority to make the overseas recipient's commitments binding and enforceable. No adequacy list exists any more, and none is coming back. Sector by sector, checked on 18 August 2026: BANKING — Banking Act Direction No. 01/2026 on outsourcing, effective 1 January 2027, permits cross-border outsourcing and cloud with board approval and annual notification to the Director of Bank Supervision; no residency clause found. PAYMENTS — the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013 contain no storage-location clause. SECURITIES — no data-location directive found in the regulator's published directives and circulars. INSURANCE — the regulator's website could not be read by automated tools, so this is recorded as unconfirmed rather than clear. HEALTH, TELECOM, EDUCATION, GAMING, GEOSPATIAL — no localisation instrument found on the responsible bodies' own sites. GOVERNMENT — the only sector where location is addressed at all, and it is a preference: the national cyber policy tells public bodies to give priority to the Lanka Government Cloud, not to stay in Sri Lanka. The one real wall is dormant: the new section 26(4) lets the Minister prescribe categories of personal data that public authorities may never send abroad. No categories have been prescribed.

The model is neither a blocklist nor an allowlist. It is closest to an unrestricted regime with a contractual accountability overlay, similar to standard contractual clauses but without a published template. Section 26(2) of the amended Act ties the required instrument to a directive issued by the Authority under section 33(c). The Authority published a document titled 'Specification of Instruments for Processing Personal Data Outside Sri Lanka Directive, 2024' for public consultation in October 2024. It is still marked DRAFT 1.0 on the Authority's own downloads page as at 18 August 2026. It lists five acceptable instruments: binding corporate rules, contractual agreements, codes of conduct, certification schemes including APEC Cross-Border Privacy Rules and schemes equivalent to the European General Data Protection Regulation, and a cross-border processing impact assessment. Critically, the draft is framed around ministerial adequacy decisions, which the 2025 amendment abolished, so it will have to be rewritten before it can be issued. Section 26(3) provides seven escape routes that do not need any instrument: explicit informed consent, necessity for a contract with the person, legal claims, public interest as defined in Schedule I, an emergency threatening life, health or safety, mere transit through Sri Lanka, and any other prescribed condition. These are drafted as full alternatives to the main rule, not as narrow exceptions, which makes them unusually generous.

Part V of the Act, which creates the Authority, was brought into force on 17 July 2023 by Extraordinary Gazette No. 2341/59, and the board was appointed in August 2023. The chairman is Rajeeva Bandaranaike; the director-general is Dimuth Bhashitha Atapattu. The Authority has published one binding circular (No. 01/2026, 7 August 2026, addressed to the public sector) and seven draft regulations and directives issued for public consultation in October 2024, none of which has been finalised. Its enforcement route under section 38 is a two-step process that most summaries miss: the Authority must first issue a directive under section 35, and only a failure to comply with that directive triggers a penalty. Sector regulators are separately active. The Central Bank of Sri Lanka issues directions and circulars regularly, including Circular No. 2/2025 on reporting information technology and cyber security incidents. The Financial Intelligence Unit supervises anti-money-laundering record-keeping. Sri Lanka CERT is operational as the national cyber agency but has no statutory power to compel incident reports — its reporting portal is voluntary and there is still no Cyber Security Act.

The floor comes from section 4 of the Financial Transactions Reporting Act, No. 6 of 2006: six years from the date of the transaction, correspondence or report, and six years from closure of the account or cessation of the business relationship for identity records, extendable by direction of the Financial Intelligence Unit. Section 4(3) adds an operational catch that matters for offshore storage: records must be kept in a manner and form that lets the institution comply IMMEDIATELY with a request from the Financial Intelligence Unit or a law enforcement agency. That is an accessibility requirement, not a location requirement, but a cold archive in another time zone will fail it. The ceiling is section 9 of the Personal Data Protection Act — the obligation to limit the period of retention — with a carve-out allowing longer storage for public-interest archiving, scientific or historical research and statistics. Section 9 sits in Part I and therefore starts on 1 January 2027. The Act resolves conflicts in favour of other laws only partially: section 3(1) makes the Act override other written laws on data protection, but a public authority governed by another law may process under that law so far as it is consistent. In practice a statutory keep-it duty is treated as a lawful purpose, so six years beats delete-when-done.

Section 23 of the Act requires a controller to notify the Authority of a personal data breach in such form, manner and within such period of time as may be determined by rules made under the Act, and leaves it to the Authority to decide when individuals must be told. Section 23 sits in Part III, which starts on 1 January 2027. The Data Breach Notification Rules were published for public consultation on 1 October 2024 and are still listed as a draft on the Authority's downloads page. So from 1 January 2027 there will be a duty with no clock attached until those rules are finalised. Count the other clocks: Sri Lanka CERT operates an incident reporting portal but there is no Cyber Security Act and no statutory hours; the Central Bank issued Circular No. 2/2025 of 7 May 2025 on the reporting of information technology and cyber security incidents of licensed banks, whose text could not be machine-read, so its deadline is recorded as unconfirmed. Sri Lanka therefore currently has, at most, one mandatory incident clock, and it applies only to banks.

(1) AGE SIXTEEN. The Act defines a child as a natural person below the age of sixteen years, and consent for a child means the consent of the parent or legal guardian. This is lower than India's eighteen and lower than most of Asia, and it also means a fifteen-year-old cannot consent for themselves. (2) PERSONAL LIABILITY OF DIRECTORS. Section 38(6) says that where a penalty is imposed on a body corporate, every director and other officer responsible for management and control is liable to pay it unless he proves he had no knowledge of the failure. The maximum is 10 million rupees (about $33,000) per non-compliance, doubling for each repeat — small by global standards, but it attaches to individuals. (3) THE CANCELLED DATE. Extraordinary Gazette No. 2366/08 of 8 January 2024 appointed 18 March 2025 for Parts I, II, III and VII. Extraordinary Gazette No. 2427/34 of 14 March 2025 repealed that paragraph, four days before it took effect. The 2025 amendment then validated past acts only under Parts V, VI, VIII, IX and X — a deliberate omission that confirms Parts I, II, III and VII were never in force. Any adviser working from the Authority's own news page, which still says 'Enforcement Begins on March 18, 2025', is working from a dead date. (4) RIGHTS ARE STILL UNSCHEDULED. The July 2026 gazette appointed sections 2 and 3 and Parts I and III. It did not mention Part II (rights of data subjects), Part IV (marketing messages) or Part VII (penalties). So from 1 January 2027 there will be duties on companies but no commenced individual rights and no commenced penalty section — while section 26 simultaneously requires you to 'ensure compliance with Part II' abroad. (5) STALE GUIDANCE. The Authority's draft cross-border directive is built around ministerial adequacy decisions that the 2025 amendment deleted. Reading it as current guidance will send you looking for an approved-country list that does not and will not exist.

CONFIRMED DATES. 1 January 2027: section 2, section 3, Part I and Part III of the Personal Data Protection Act commence, per Extraordinary Gazette No. 2498/16 of 22 July 2026. 1 January 2027: Banking Act Directions No. 01 of 2026 on outsourcing take effect and revoke the 2012 directions. EXPECTED. The Authority's Circular No. 01/2026 of 7 August 2026 says new enforcement dates are 'expected to be announced soon' and that advisory committees will be formed for finance and banking, insurance, health, telecommunications, civil registration and tourism, with sectoral guidelines to follow under the new section 51A. Seven draft regulations and directives from October 2024 remain unfinalised. DORMANT SWITCHES, each of which can change the picture without consultation. (1) The Minister may prescribe categories of personal data that public authorities may never send abroad, under new section 26(4) and (5). Nothing prescribed. (2) The Minister may by gazette order appoint a commencement date for any remaining provision at any time, including Part VII penalties, with no minimum notice — the 2025 amendment removed the old timing constraints entirely. (3) The Authority may issue the section 33(c) directive specifying transfer instruments, which turns a paper obligation into a concrete contracting project overnight. (4) Regulations under section 20(1)(b) may prescribe the scale and magnitude of processing that forces a private company to appoint a data protection officer. None prescribed. Separately, Part IV, on using personal data to send marketing messages, has never been commenced and now has no deadline for commencement at all, because the amendment repealed the eighteen-to-forty-eight-month window in the original section 1.