Sri Lanka Personal Data Protection Act (PDPA No. 9 of 2022): Compliance Roadmap
A practical legal and technical implementation guide for data controllers and data processors handling consumer data in Sri Lanka.
Sri Lanka's Landmark Data Privacy Legislation
The Personal Data Protection Act No. 9 of 2022 represents a comprehensive regulatory milestone for digital businesses in Sri Lanka, creating stringent obligations for Data Controllers and Data Processors regarding consent, transparency, and data subject rights.
Key Obligations for Organizations
Legitimate Processing and Explicit Consent: Data must only be collected for specified, explicit, and legitimate purposes.
Data Protection Officers (DPO): Designating a qualified DPO to oversee compliance.
Mandatory Data Subject Rights: Facilitating rights to access, rectification, erasure, and objection within statutory deadlines.
Technical Safeguards Mandated by the Act
The Act explicitly requires organizations to implement appropriate technical and organizational measures (encryption, pseudonymization, access control, and audit logs) to protect personal data from unauthorized destruction, loss, or disclosure.
Related Articles & Advisories
ISO/IEC 27001:2022 Transition: Navigating the 93 Reorganized Controls
A comprehensive practitioner guide to transitioning from the 2013 standard to the 2022 edition, including the 11 brand-new security controls.
NIST Cybersecurity Framework (CSF) 2.0: Operationalizing the 'Govern' Function
How the landmark addition of the GOVERN function bridges cybersecurity engineering with board-level enterprise risk management.
PCI-DSS v4.0 Compliance Checklist for E-Commerce & FinTech Operators
Navigating the strict client-side script inspection (Requirement 6.4.3/11.6.1), multi-factor mandates, and targeted risk analysis.