️Janaka Suranga
The Ministry of Technology has confirmed that the legal operations of the Personal Data Protection Act, which aims to regulate the processing of personal data, safeguard personal data, recognize and strengthen the rights of data subjects, and provide comprehensive protection for Sri Lankan citizens, is fully enforced starting from March 2025. In response to a query under the Right to Information Act about the effective date of this Act, the Ministry’s Information Officer, K.D. Godigamuwa stated that its legal operations would be fully implemented from March 18, 2025.
The Personal Data Protection Act, which holds a significant place among the controversial laws passed in recent times, was approved by Parliament on March 9, 2022. This Act was crafted by considering the laws and regulations that ensure personal data protection in developed countries around the world.
Based on modern technology and global trends, the Act focuses on protecting the personal data rights of data subjects, facilitating the development and modernization of Sri Lanka’s digital economy, and improving interoperability between data protection frameworks. Additionally, it aims to strengthen cross-border cooperation between data protection authorities. The preamble of the Act further states that it creates a legal framework to ensure mechanisms for protecting the personal data of data subjects, respecting domestic written laws, and relevant international conventions while ensuring consumer trust and privacy.
Despite the Act becoming law in Sri Lanka with the signing by the Honorable Speaker on March 19, 2022, the full enforcement, which includes the establishment of the necessary Data Protection Authority, has remained a matter of public curiosity. The response from the Ministry of Technology to an RTI application has resolved several issues regarding its implementation.
According to the response, the Act began to be implemented in stages following the issuance of Extraordinary Gazette Notification No. 2341/59 on July 21, 2023, which enacted Part V of the Personal Data Protection Act No. 9 of 2022.
Extraordinary Gazette Notification No. 2366/08, issued on January 8, 2024, designated December 1, 2023, as the effective date for Parts VI, VIII, IX, and X of the Act, and March 18, 2025, as the effective date for Parts I, II, III, and VII, by Hon. Ranil Wickremesinghe in his capacity as President and Minister of Technology. Consequently, from March 18, 2025, the full legal operations of the Act will be enforced, providing comprehensive protection to Sri Lankan citizens.
Data Protection Authority
The Data Protection Authority, established under this Act, is a crucial institution. Its official office is located on the first floor of Building No. 05 within the Bandaranaike Memorial International Conference Hall premises on Bauddhaloka Mawatha, Colombo 07. The President appointed all official positions of the Authority on August 10, 2023. The board members are as follows:
Board of Directors
- Senior Chartered Accountant Arjuna Therath – Director and Chairman
- Dr. Sulakshana Jayawardhana – Director
- Bimsara Senavirathna – Director
- Attorney-at-Law Nisith Abesuriya – Director
- President’s Counsel Soumya Amarasekara – Director
- Shehan Wijethilake – Director
- Jayanta Pranandu – Director
Therefore, the public now has the power to submit their complaints in writing or in person to the Chairman/Director General, Data Protection Authority, First Floor, Building No. 5, Bandaranaike Memorial International Conference Hall (BMICH), Bauddhaloka Mawatha, Colombo 07.
Recent Comments