Data Protection Authority issues new circular ahead of 2027 compliance date

The Data Protection Authority has issued a new circular setting out how state institutions should prepare for the parts of Sri Lanka’s data protection law that come into force at the start of 2027.

Personal Data Protection Circular No. 01/2026 applies to ministries, government departments, provincial councils, local authorities, public corporations, statutory institutions and state-owned enterprises — the bodies the law treats as public authorities. It replaces DPA Circular No. 01/2024, issued in September 2024.

What takes effect in January

The circular follows an Extraordinary Gazette order issued by the President on 22 July, which set 1 January 2027 as the date on which Sections 2 and 3, Part I and Part III of the Personal Data Protection Act No. 9 of 2022 come into operation. The Act was amended last year by Act No. 22 of 2025.

Part I governs the processing of personal data and Part III covers controllers and processors. Together with Sections 2 and 3, they establish the core legal obligations that public authorities must follow when handling the personal data of individuals.

What institutions are told to do now

The Authority’s guidance is aimed at the transition period before those provisions bite. It asks institutions to put appropriate governance arrangements in place, appoint Data Protection Officers where required, and implement Data Protection Management Programmes.

Institutions are also directed to carry out personal data audits and gap assessments, and to conduct data protection impact assessments where applicable. The circular calls for institutional policies and procedures to be strengthened and for staff awareness and training to be built up.

The Authority said the circular includes a practical approach to help institutions begin work, and urged public sector bodies to start implementation without delay so they are adequately prepared before the provisions take effect.

Further implementing rules, regulations, directives and guidelines will be issued to support the framework, the Authority said.

Sources: Ada Derana.