Personal Data Protection Act dates of operation announced

• Enforcement to start from 18 March 2025

The Data Protection Authority (DPA) has announced that Personal Data Protection Act will become operational from 2025 and enforcement will be from 18 March onwards.

Through an Extraordinary Gazette issued by the President as the Minister of Technology by virtue of the powers vested in him by the Personal Data Protection Act (PDPA), No. 9 of 2022 and the Constitution of the Democratic Socialist Republic of Sri Lanka, the following dates have been notified for the operationalization of the PDPA:

(a) 1 December 2023 as the date on which the provisions of Part VI, VIII, IX and X of the aforesaid Act shall come into operation; and

(b) 18 March 2025 as the date on which the provisions of part I, II, III and VII of the aforesaid Act shall come into operation.

The Part V of the Data Protection Act was brought into operation in July 2023 which enabled the President to appoint the Chairman and the Board of Directors of the Data Protection Authority (DPA). The Chairman and the Board were appointed subsequently and announced in October 2023. The DPA serves as the Regulator for safeguarding rights of citizens related to processing of personal data by state and private sector parties. The PDPA is also expected to be a facilitator for growth and innovation in the digital economy, as stated in its preamble of the PDPA.

As per the latest Gazette Notification, the PDPA will be fully operational and enforced, commencing 18 March 2025. Part IV of the Act, which deals with the provisions of the ‘use of personal data to disseminate solicited messages’ will be brought into operation at a subsequent date as provided for in the Act, which is not earlier than 24 months and not later than 48 months from the date the Act was certified by the Speaker.

By bringing Part VI, VIII, IX and X of the aforesaid Act into operation from 1 December 2023, the Data Protection Authority is empowered to create the fund of the Authority and take steps to formulate Rules under Section 52 of the Act for the schemes of recruitment of the Director General/ key staff members, delegation of authority for the Director General and staff as well as take other operational steps to establish a fully functional Authority to implement the PDPA effectively. 

This will enable the DPA to recruit and appointing a Director General and key staff, through an open, transparent and competitive process, create the institutional infrastructure and capacity, and create awareness among key stakeholders before enforcing the Act commencing 18 March 2025.

The DPA expects to formulate the policy framework and the Rules and Regulations to enforce the Act, using a consultative approach, during the 2nd and 3rd quarters of 2024 and create awareness of these policies, rules, and regulations during the 4th quarter of 2024 and 1st quarter of 2025.