SRI LANKA PDPA LEGAL LIBRARY
A curated library of primary legislation, regulator publications, consultation materials, circulars, and practical resources for PDPA readiness and implementation.
HOW TO USE THIS LIBRARY
Start with the Act
Use the primary legislation to understand the legal framework.
Check current official notices
Review DPA publications and Gazette-linked operational updates.
Turn sources into controls
Use the checklist and playbook to translate obligations into evidence.
IMPORTANT LEGAL NOTE
This library is a practical research starting point, not legal advice. Verify current status, commencement dates, regulations, and official interpretations directly against the latest official Gazette and Data Protection Authority publications before relying on a source.
PRIMARY LEGAL SOURCES
ACT · 2022
Sri Lanka’s primary personal-data protection legislation. Start here for the statutory framework governing processing, data-subject rights, controllers, processors, the DPA, and related obligations.
REGULATOR · Current
The official regulator website for announcements, guidance, publications, consultation materials, contact details, and PDPA-related updates.
GUIDANCE HUB · Current
Official DPA page hosting the Act and consultation materials, including proposed regulations on DPIAs, DPO appointments, and data-subject rights.
OPERATIONALISATION · Published notice
Official DPA summary of operationalisation notices and dates. Check this source together with the latest Gazette notices, as operational dates can change.
REGULATIONS, CIRCULARS, AND GUIDANCE
Regulations and guidance can materially affect how organisations appoint privacy leadership, conduct DPIAs, handle rights requests, and implement controls. Draft and consultation documents should be treated as informative until formally issued or enacted.
DPIA REGULATION · 2024 consultation
Draft framework for when and how organisations should assess privacy impacts of high-risk processing before proceeding.
DPO REGULATION · 2024 consultation
Consultation material on DPO appointment, scale, qualification, and related requirements.
RIGHTS REGULATION · 2024 consultation
Consultation material concerning the exercise of data-subject rights and appeals procedures.
PUBLIC-SECTOR CIRCULAR · 13 September 2024
Official circular concerning application of the PDPA in the public sector.
THE PDPA, IN PRACTICE
A defensible privacy programme connects legal obligations to accountable people, transparent processing, secure systems, working rights processes, vendor oversight, evidence, and ongoing review.
Governance
Leadership oversight, DPO capability, policies, and accountability.
Data operations
Inventory, processing records, purpose, lawful basis, and retention.
Rights and trust
Notices, consent where relevant, rights workflows, and response records.
Security and assurance
Safeguards, incidents, vendors, DPIAs, testing, metrics, and remediation.
IMPLEMENTATION TOOL · PDPA.COM.LK
Interactive, evidence-led control tracker across governance, processing records, rights, security, retention, vendors, DPIAs, and assurance.
IMPLEMENTATION GUIDE · PDPA.COM.LK
A structured route from mobilisation and data mapping through control implementation, evidence, testing, and continuous improvement.
READINESS TOOL · PDPA.COM.LK
Structured assessment to help identify privacy maturity, material gaps, priority actions, and an executive-ready starting view.
REGULATOR OVERVIEW · Current
Overview of the Authority, its purpose, and its role in implementing and overseeing Sri Lanka’s PDPA framework.
FROM LEGAL SOURCE TO DELIVERY PLAN
Use the readiness assessment to identify gaps, the advanced checklist to assign and evidence controls, and the implementation playbook to structure the work.