Sri Lanka’s Data Protection Rules: 1 January 2027 Is the Date to Plan For
The Data Protection Authority has issued guidance for public bodies, and core PDPA duties start in 2027. Here is what it means for businesses.
Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, is moving from paper to practice. The Data Protection Authority (DPA) has issued Personal Data Protection Circular No. 01/2026 for the public sector, and a gazette notice published in July 2026 points to 1 January 2027 for the Act’s core rules on processing personal data and the duties of controllers and processors.
What the circular asks of public bodies
According to reporting in the Daily News, the circular asks government institutions to appoint Data Protection Officers, run data protection management programmes, carry out data audits and gap assessments, prepare data protection impact assessments for higher-risk processing, and train staff. The Act itself was amended by Act No. 22 of 2025, which, according to a summary by the law firm DLA Piper, removed earlier grace periods.
Why private businesses should pay attention
The circular is aimed at the public sector, but the Act applies to private organisations too. Shops, clinics, schools, hotels and online sellers all hold customer names, phone numbers, addresses and payment records. CCTV footage of identifiable people is personal data as well.
Five practical steps to start now
- List what you hold: customer records, staff files, CCTV recordings, website form entries and backups.
- Limit access: give each person only the accounts and folders they need, and turn on multi-factor authentication.
- Set retention periods: decide how long you keep CCTV footage and old records, then delete on schedule.
- Update notices: publish a clear privacy notice and put CCTV signs where cameras record.
- Protect backups: encrypt laptops and keep an offline or cloud copy of important data.
This is general information, not legal advice. For the exact obligations that apply to your organisation, speak to a legal adviser. For the technical side (access control, encryption, secure backups and CCTV retention settings), our cybersecurity team can help. Call +94 72 299 9915 or info@eudora.lk.
Source: Daily News, 10 August 2026; DPA Circular No. 01/2026; Gazette No. 2498/16.
Eudora Technology is a Kandy-based team working on CCTV, networks, IT support, cloud and websites for homes and businesses across Sri Lanka.
