Personal Data Protection Act enforcement pushed back by six months

• Ministry of Digital Economy says delay due to public sector readiness concerns

The enforcement of Sri Lanka’s Personal Data Protection Act (PDPA) has been delayed by six months, with the government citing public sector readiness concerns. 

The Ministry of Digital Economy, in a statement confirmed the extension, emphasising the need for additional time to ensure full compliance across all levels of the government.

The Act, originally set to take effect on March 18, 2025, will now be operationalised at a later date following amendments approved by the Cabinet of Ministers. According to the Ministry, the delay is in response to requests from multiple stakeholders, particularly from the public sector, who require more time to strengthen their human and technical infrastructure to meet enforcement requirements.

Recognising the importance of a “future-ready enforcement regime,” the government said it was necessary to support the establishment of a fully-fledged regulator with the capacity to “meaningfully address the rights of data subjects” before the Act is brought into operation.

“Many stakeholders, especially from the public sector, have expressed the need for additional time to enhance their human and technical infrastructure, enabling them to fully comply with the enforcement provisions of the Act,” the Ministry of Digital Economy stated.

As South Asia’s first comprehensive data protection legislation, the PDPA is designed to safeguard citizens’ data rights while fostering growth in the digital economy. However, some public sector institutions have requested amendments to allow them “more flexibility in making technology choices, similar to the private sector, to enable the adoption of AI systems.”

Given that the PDPA applies to all levels of government—including Central Government, Provincial Councils, Local Authorities, Divisional Secretariats, and Grama Niladhari divisions—the government acknowledged the need to “create more capacity” and provide additional time for compliance.

The Cabinet has also approved amendments to multiple sections of the Act, covering enforcement, data processing requirements, and regulatory mechanisms. The Ministry of Digital Economy, in consultation with the Data Protection Authority and the Legal Draftsman’s Department, will publish the amendments on its website in the coming weeks.

The government is now in the process of submitting the revised legislation to Parliament for approval, ensuring that the Act can be fully operationalised with stronger regulatory oversight and broader industry adoption.