Personal Data Protection Act, No. 9 of 2022

Section 2 gives it GDPR-style extraterritorial reach: it applies to controllers and processors established in Sri Lanka, and to those outside Sri Lanka that offer goods or services to data subjects in Sri Lanka or monitor their behavior there. It carries a familiar apparatus — lawful bases, data-subject rights, DPO appointment for specified controllers, breach notification, and cross-border transfer controls — enforced by the Data Protection Authority of Sri Lanka, which was established ahead of the substantive provisions. Read the date line carefully, because an earlier commencement was reversed and the obligations are NOT yet in force. An Order appointing March 18, 2025 for Parts I, II, III and VII was repealed by Gazette Extraordinary No. 2427/34 of March 14, 2025, four days before it would have taken effect, so those Parts never commenced. The Personal Data Protection (Amendment) Act, No. 22 of 2025 (certified October 30, 2025) then removed the Act's fixed grace-period timetable altogether, leaving commencement wholly to an Order of the Minister published in the Gazette. Gazette Extraordinary No. 2498/16 of July 22, 2026 supplies that Order for the core of the regime: Part I (processing of personal data) and Part III (controllers and processors) come into operation January 1, 2027. Part II (rights of data subjects) and Part VII (offences and penalties) await a further Order, and Part IV (unsolicited messages) remains unappointed — so from January 1, 2027 Sri Lanka runs an unusual interim regime in which controller obligations bind before the data-subject rights and penalty provisions that would ordinarily enforce them. Marked 'check': the gazettes are not available in machine-readable form and the Authority's own 'dates of operation' page still displays the repealed March 18, 2025 notice, so this timeline was triangulated across independent legal-reference sources and Sri Lankan press reporting — confirm the current Orders with the Authority before relying on any single date.