PDPA Sri Lanka 2027: What Changes and Your Compliance Checklist
Sri Lanka's Data Protection Act takes effect on 1 January 2027. What it means for marketing, SEO and IT teams, with a quick PDPA compliance checklist.
Online Lawyer Global
11/8/20262 min read
PDPA Sri Lanka 2027: what changes on 1 January
On 1 January 2027, the core of Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) becomes binding law under Extraordinary Gazette No. 2498/16. If your business collects names, phone numbers, emails, passport copies, CVs or website visitor data, it applies to you, whether you are a Sri Lankan company or a foreign business selling to people in Sri Lanka.
In force from 1 January: the rules on collecting, using, storing, securing and transferring personal data abroad, and the duties of businesses and their service providers.
Coming later: individuals' formal rights (access, correction, erasure), the unsolicited-marketing rules and fines.
"No fines yet" does not mean "no risk"
From day one, the Data Protection Authority can investigate, issue binding directives and order compensation. Fines of up to LKR 10 million per breach of a directive are expected within about a year, and directors are personally liable unless they can prove due diligence. What you do in 2027 will be the evidence.
What the Data Protection Act means for your team
Marketing: know where every contact came from, get genuine (not pre-ticked) consent, and sign a data processing agreement with your agency. Data about under-16s needs special care.
SEO and web: analytics and ad pixels should not fire before visitors agree; collect only what your forms need; replace copied privacy policies with one written for Sri Lankan law.
IT: map what data you hold and where, tighten access and encryption, keep a breach plan, and check the safeguards for data stored abroad (Google Workspace, Microsoft 365, AWS).
HR and operations: CVs, NIC copies and salary records are personal data too. Stop sharing them over personal WhatsApp.
PDPA compliance checklist
Appoint one accountable person (or a DPO where required).
Map your personal data and where it goes.
Fix your privacy notice, cookie banner and forms.
Clean your marketing lists.
Sign processing agreements with vendors and agencies.
Set retention, security and breach rules.
Document it all in a Data Protection Management Programme.
Quick self-test: is your business PDPA-ready?
Can you list all the personal data you hold and where it is stored?
Do your website tags wait for visitor consent?
Is your privacy notice written for Sri Lankan law?
Do you have signed agreements with your agencies and IT vendors?
Do you have a tested breach response plan?
Two or more "no" answers? Book a PDPA compliance check before 1 January 2027. We review your website, forms, marketing lists, contracts, cloud hosting and security, and give you a red-amber-green report with ready-to-use documents.
Contact Online Lawyer Global: info@onlinelawyerglobal.com · +94 77 717 8075 · +94 72 446 5556 (phone and WhatsApp) · Mount Lavinia and Galle
PDPA FAQs
When does Sri Lanka's PDPA come into force? The core business obligations apply from 1 January 2027; individuals' rights, marketing rules and fines follow later.
Does the PDPA apply to foreign companies? Yes, if they sell to or track people in Sri Lanka.
How do I check if my business is PDPA compliant? Start with the self-test above, then commission a PDPA compliance check.
General information as at 10 November 2026, not legal advice.