Sri Lanka

Section 2 of the Personal Data Protection Act, No. 9 of 2022 sets out four hooks. Work that happens wholly or partly in Sri Lanka. A company or person that decides how data is used, or handles it for someone else. That party must be based or ordinarily resident in Sri Lanka, or set up under Sri Lankan law. A company that offers goods or services to people in Sri Lanka, including by targeting them specifically. And one that specifically monitors their behaviour, including profiling. Extraordinary Gazette No. 2498/16 of 22 July 2026 sets 1 January 2027 as the start date for sections 2 and 3, and for Part I and Part III. Section 3(1) gives the Act priority over other written laws on data protection. Unlike India or the European Union, Sri Lanka does not require a foreign company to appoint an in-country representative. You only need a Data Protection Officer where section 20 applies. Since the 2025 amendment, that officer may be an outsourced third party.

This is the single most important thing to understand about Sri Lanka. The original section 26 of the 2022 Act set up a European-style system of safe countries. The Minister would declare which countries protected data well enough. Public authorities had to keep their work inside Sri Lanka unless a declaration covered them. The Personal Data Protection (Amendment) Act, No. 22 of 2025, certified on 30 October 2025, repealed that section outright and replaced it. The new section 26 is about accountability instead. You may send data abroad only if Part I, Part II and sections 20 to 25 are complied with. That applies wherever the data sits. You must also use the documents specified by a directive of the Authority, so that the overseas recipient's promises are binding and enforceable. No list of safe countries exists any more, and none is coming back. Industry by industry, checked on 18 August 2026. BANKING: Banking Act Direction No. 01/2026 on outsourcing, effective 1 January 2027, allows outsourcing and cloud abroad with board approval and annual notice to the Director of Bank Supervision. We found no rule that the data must stay in the country. PAYMENTS: the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013 set no storage-location rule. SECURITIES: we found no data-location rule in the regulator's published directives and circulars. INSURANCE: we could not read the regulator's website, so this is recorded as unconfirmed rather than clear. HEALTH, TELECOMS, EDUCATION, GAMING and GEOSPATIAL: we found no rule about where data must sit on the responsible bodies' own sites. GOVERNMENT: the only area where location is addressed at all, and it is a preference. The national cyber policy tells public bodies to give priority to the Lanka Government Cloud. It does not tell them to keep data in Sri Lanka. The one real ban is unused. The new section 26(4) lets the Minister name categories of personal data that public authorities may never send abroad. No categories have been named.

Sri Lanka has neither a list of banned countries nor a list of approved ones. The closest description is open transfers with a contract requirement on top. It works like Europe's standard contract clauses, but with no published template. Section 26(2) of the amended Act ties the required paperwork to a directive that the Authority issues under section 33(c). The Authority published a document titled 'Specification of Documents for Processing Personal Data Outside Sri Lanka Directive, 2024' for public consultation in October 2024. It is still marked DRAFT 1.0 on the Authority's own downloads page as at 18 August 2026. It lists five acceptable options. Binding corporate rules. Contracts. Codes of conduct. Certification schemes, including APEC Cross-Border Privacy Rules and schemes equivalent to the European General Data Protection Regulation. And a cross-border impact assessment. The draft is built around ministerial decisions that a country is safe enough, and the 2025 amendment abolished those. So it will have to be rewritten before it can be issued. Section 26(3) gives seven escape routes that need no paperwork at all. Explicit informed consent. Necessity for a contract with the person. Legal claims. Public interest as defined in Schedule I. An emergency threatening life, health or safety. Data merely passing through Sri Lanka. And any other condition that may be prescribed. These are written as full alternatives to the main rule, not as narrow exceptions, which makes them unusually generous.

Part V of the Act, which creates the Authority, came into force on 17 July 2023 by Extraordinary Gazette No. 2341/59. The board was appointed in August 2023. The chairman is Rajeeva Bandaranaike. The director-general is Dimuth Bhashitha Atapattu. The Authority has published one binding circular, No. 01/2026 of 7 August 2026, addressed to the public sector. It also published seven draft regulations and directives for public consultation in October 2024. None of them has been finalised. Its enforcement route under section 38 has two steps, which most summaries miss. The Authority must first issue a directive under section 35. Only a failure to follow that directive brings a penalty. Industry regulators are separately active. The Central Bank of Sri Lanka issues directions and circulars regularly, including Circular No. 2/2025 on reporting information technology and cyber security incidents. The Financial Intelligence Unit supervises anti-money-laundering record-keeping. Sri Lanka CERT works as the national cyber agency, but it has no legal power to force incident reports. Its reporting portal is voluntary, and there is still no Cyber Security Act.

The floor comes from section 4 of the Financial Transactions Reporting Act, No. 6 of 2006. Six years from the date of the transaction, correspondence or report. Six years from closure of the account, or from the end of the business relationship, for identity records. The Financial Intelligence Unit can direct a longer period. Section 4(3) adds a catch that matters if you store records abroad. The institution must be able to comply IMMEDIATELY with a request from the Financial Intelligence Unit or a law enforcement agency. Records must be kept in a manner and form that allows that. That is about how fast you can produce them, not about where they sit. But a cold archive in another time zone will fail it. The ceiling is section 9 of the Personal Data Protection Act, the duty to limit how long you keep data. It allows longer storage for public-interest archiving, scientific or historical research and statistics. Section 9 sits in Part I, so it starts on 1 January 2027. The Act only partly resolves conflicts. Section 3(1) makes the Act override other written laws on data protection. But a public authority governed by another law may work under that law so far as it is consistent. A legal duty to keep records is treated as a lawful purpose, so six years beats delete-when-done.

Section 23 of the Act requires you to notify the Authority of a personal data breach. The form, the manner and the time limit are all left to rules made under the Act. The Authority also decides when individuals must be told. Section 23 sits in Part III, which starts on 1 January 2027. The Data Breach Notification Rules were published for public consultation on 1 October 2024. They are still listed as a draft on the Authority's downloads page. So from 1 January 2027 there will be a duty with no clock attached, until those rules are finalised. Count the other clocks. Sri Lanka CERT runs an incident reporting portal, but there is no Cyber Security Act and no legal deadline. The Central Bank issued Circular No. 2/2025 of 7 May 2025 on reporting information technology and cyber security incidents at licensed banks. We could not read its text, so its deadline is recorded as unconfirmed. So Sri Lanka currently has at most one compulsory incident clock, and it applies only to banks.

(1) AGE SIXTEEN. The Act defines a child as a person below the age of sixteen years. Consent for a child means consent from the parent or legal guardian. That is lower than India's eighteen, and lower than most of Asia. It also means a fifteen-year-old cannot consent for themselves. (2) DIRECTORS PAY PERSONALLY. Section 38(6) covers penalties imposed on a company. Every director and other officer responsible for management and control is liable to pay it. The only way out is to prove you had no knowledge of the failure. The maximum is 10 million rupees (about $33,000) for each failure, doubling for each repeat. That is small by global standards, but it attaches to individuals. (3) THE CANCELLED DATE. Extraordinary Gazette No. 2366/08 of 8 January 2024 set 18 March 2025 for Parts I, II, III and VII. Extraordinary Gazette No. 2427/34 of 14 March 2025 repealed that paragraph, four days before it took effect. The 2025 amendment then validated past acts only under Parts V, VI, VIII, IX and X. That deliberate omission confirms Parts I, II, III and VII were never in force. Any adviser working from the Authority's own news page, which still says 'Enforcement Begins on March 18, 2025', is working from a dead date. (4) RIGHTS ARE STILL UNSCHEDULED. The July 2026 gazette appointed sections 2 and 3, and Parts I and III. It did not mention Part II (rights of individuals), Part IV (marketing messages) or Part VII (penalties). So from 1 January 2027 there will be duties on companies, but no individual rights in force and no penalty section in force. Meanwhile section 26 requires you to 'ensure compliance with Part II' abroad. (5) STALE GUIDANCE. The Authority's draft cross-border directive is built around ministerial decisions that a country is safe enough. The 2025 amendment deleted those. Read it as current guidance and you will go looking for an approved-country list that does not exist and never will.

CONFIRMED DATES. 1 January 2027: section 2, section 3, Part I and Part III of the Personal Data Protection Act start, under Extraordinary Gazette No. 2498/16 of 22 July 2026. 1 January 2027: Banking Act Directions No. 01 of 2026 on outsourcing take effect and revoke the 2012 directions. EXPECTED. The Authority's Circular No. 01/2026 of 7 August 2026 says new enforcement dates are 'expected to be announced soon'. It also says advisory committees will be formed for finance and banking, insurance, health, telecommunications, civil registration and tourism. Guidelines for each industry will follow under the new section 51A. Seven draft regulations and directives from October 2024 are still unfinished. UNUSED POWERS, each of which can change the answer without consultation. (1) The Minister may name categories of personal data that public authorities may never send abroad, under new section 26(4) and (5). Nothing has been named. (2) The Minister may by gazette order set a start date for any remaining part of the Act at any time. That includes the Part VII penalties, and there is no minimum notice. The 2025 amendment removed the old timing limits entirely. (3) The Authority may issue the section 33(c) directive specifying what transfer paperwork you need. That turns a paper duty into a concrete contracting project overnight. (4) Regulations under section 20(1)(b) may set the scale of activity that forces a private company to appoint a data protection officer. None have been made. Separately, Part IV, on using personal data to send marketing messages, has never been started. It now has no deadline for starting at all, because the amendment repealed the eighteen-to-forty-eight-month window in the original section 1.