Personal Data Protection Act (Sri Lanka)

Personal Data Protection Act, No. 9 of 2022
Parliament of Sri Lanka
Long title An Act to provide for the regulation of processing of personal data; to identify and strengthen the rights of data subjects in relation to the protection of personal data; to provide for the establishment of the Data Protection Authority; and to provide for matters connected therewith or incidental thereto
Citation	Personal Data Protection Act, No. 9 of 2022
Territorial extent	Worldwide
Enacted by	Parliament of Sri Lanka
Enacted	March 9, 2022
Signed by	Speaker of the Parliament
Signed	March 19, 2022
Effective	July 17, 2023 (Part V) December 1, 2023 (Parts VI, VIII, IX, X) March 18, 2025 (Parts I, II, III, VII)
Administered by	Data Protection Authority of Sri Lanka
Legislative history
Bill title	Personal Data Protection Bill
Bill citation	Personal Data Protection Bill
Introduced by	Minister of Technology
Introduced	November 25, 2021
First reading	January 20, 2022
Second reading	March 9, 2022
Third reading	March 9, 2022
Keywords
Data protection, Privacy, Personal data
Status: Not fully in force

The Personal Data Protection Act, No. 9 of 2022 (abbreviated PDPA) is a comprehensive data protection law enacted to regulate the processing of personal data in Sri Lanka.^[1] The Act aims to protect the privacy of individuals, establish rights for data subjects, and impose obligations on data controllers and processors.