A practical roadmap for Sri Lanka's Personal Data Protection Act

The Personal Data Protection Act, No. 9 of 2022 gives organisations in Sri Lanka a comprehensive data protection regime for the first time. For most, the challenge isn't understanding the principles — lawfulness, purpose limitation, minimisation, security — but turning them into work that can be sequenced, resourced and evidenced.

Start with a map, not a policy

The most common mistake is to begin by drafting a privacy policy. A policy written before you know what data you hold will either promise too much or describe too little. Begin instead with a record of processing: what personal data each function collects, why, on what basis, where it is stored, who receives it and how long it is kept.

• Interview process owners, not only IT
• Follow data across vendors and group companies
• Flag special categories such as health and financial data early
• Note every transfer outside Sri Lanka

Prioritise by exposure

Once the map exists, rank processing activities by volume, sensitivity and visibility to data subjects. Customer-facing processing involving sensitive data usually comes first; internal administrative processing can follow. This gives you a defensible order of work if a regulator asks why something isn't finished.

Build the operating rhythm

Readiness is not a single deliverable. The Act expects ongoing duties: responding to data subject requests, assessing high-risk processing, managing processors and handling breaches. Assign owners, set internal timelines shorter than the statutory ones and keep records of every decision.

Show progress honestly

Boards respond better to a clear plan with visible gaps than to a green dashboard that collapses under scrutiny. Report what is complete, what is in progress and which risks are being accepted in the meantime.