Veterinary clinics
Owner names, phone numbers and addresses, appointment history, payment details and reminder lists for vaccinations.
Sri Lanka PDPA readiness
Is Your Business Ready for Sri Lanka's Data Protection Requirements?
Your business collects customer information every day. Learn what Sri Lanka's Personal Data Protection Act means for your organisation and discover which areas you may need to improve.
Core PDPA duties start on 1 January 2027.
The law in plain English
What is Sri Lanka's PDPA?
The Personal Data Protection Act, No. 9 of 2022 sets out how organisations in Sri Lanka should collect, use, store and share information about people. It was amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025.
Handling customer information responsibly is about trust. People share their details because they expect you to use them for the reason they were given, keep them safe and not keep them longer than you need.
The Act does not set one checklist for everyone. What a business needs to do depends on the kinds of personal data it holds, how much, and what it does with it. Some topics, such as breach reporting and impact assessments, will be explained further in rules from the Data Protection Authority.
Key dates
- 19 March 2022
The Personal Data Protection Act, No. 9 of 2022 is certified and becomes law.
- July and December 2023
The parts of the Act that set up and run the Data Protection Authority come into operation.
- 30 October 2025
The Act is amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025.
- 1 January 2027
Core PDPA duties start: the rules on processing personal data (Part I) and the duties of controllers and processors (Part III).
Source: Gazette Extraordinary No. 2498/16. The Act's sections on individuals' rights (Part II) and penalties (Part VII) do not yet have a start date.
Everyday examples
Does this affect my business?
If you keep information that identifies people, the PDPA is likely to be relevant. Here is what that often looks like.
Hotels and guesthouses
Booking details, guest registration forms, passport or ID copies, special requests and messages sent through WhatsApp or booking platforms.
Online shops
Delivery addresses, order history, payment records, customer accounts and email or SMS marketing lists.
Schools and education providers
Student records, parent contact details, attendance and results. Data about children under 16 is a special category under the Act.
Clinics and healthcare providers
Patient records, test results, prescriptions and appointment notes. Health data is also a special category under the Act.
Not on the list?
Most businesses that keep customer or staff details have something to review. The checker works for any sector.
A practical starting point
What should businesses review?
These are common areas to look at. Not every point applies in the same way to every business, and some are good practice rather than a legal requirement for everyone.
What personal information you collect
The types of data you hold about customers, staff and suppliers, on paper and in software.
Why you collect it
The purpose for each type of data, and the lawful reason you rely on to use it.
How it is stored and protected
Where the data lives, how it is backed up and the measures that keep it secure.
Who has access
Which staff and which outside providers can see or use the data, including overseas tools.
Whether your privacy information is clear
What you tell people about how you use their data, and where they can find it.
How requests and incidents are handled
What happens when someone asks about their data, or when data is lost or exposed.
Free, about five minutes
The free PDPA Readiness Checker
See where your business stands today and what to look at first. You see your results before we ask for any contact details.
- 1
Answer a few simple questions
Plain-English questions about how your business handles personal data. No documents or customer records needed.
- 2
Receive an indicative readiness assessment
See an overall readiness score and how you are doing in each area, straight away.
- 3
Discover practical next steps
Find out which areas may need attention first and what evidence is worth building.
Check Your PDPA Readiness for Free
An indicative readiness score, not legal advice or a certification.
In development
Introducing Comply by MetaXell
Comply is an upcoming platform designed to make data protection management simpler for Sri Lankan businesses. It is being built for teams without a dedicated legal or compliance department.
The aim is to help you build your PDPA readiness and evidence in one place, so you can show what you have done rather than keep it in scattered files and inboxes.
Planned capabilities
Features under development. Final scope may change.
- Guided data inventories
- Privacy notice preparation
- Task tracking for data protection work
- Evidence organisation
- Incident records
- Ongoing readiness monitoring
Sri Lanka PDPA FAQs
Short answers to common questions.
What is Sri Lanka's PDPA?
The Personal Data Protection Act, No. 9 of 2022 is Sri Lanka's main law on how organisations collect, use, store and share personal data. It was amended in 2025. The core duties on processing personal data start on 1 January 2027.
Does it apply to small businesses?
The Act applies to organisations that process personal data in Sri Lanka, and it does not exempt a business only because it is small. What you need to do depends on the data you hold and how you use it, so a small shop and a busy clinic will have different priorities. If you are unsure how it applies to you, speak to a qualified Sri Lankan lawyer.
Is the Readiness Checker free?
Yes. You can answer the questions and see your readiness level and area scores without giving any contact details. If you would like the detailed report, a consultation or a place on the Comply waiting list, you can choose to leave your details.
How long does the assessment take?
About five minutes. You can move back and forth between questions and choose "Not sure" if you do not know an answer.
Does completing the assessment mean my business meets the PDPA?
No. The checker gives an indicative readiness score based on your own answers. It is not legal advice, a certification or an audit, and it cannot confirm whether your business meets the law. It helps you see where to focus next.
What is Comply by MetaXell?
Comply is a platform MetaXell is building to help Sri Lankan businesses organise their data protection work: records, notices, tasks and evidence in one place. It is in development, and you can join the waiting list from the Readiness Checker.
Build your PDPA readiness and evidence
Take the free check, see your readiness level and find out which areas to look at first. It takes about five minutes.
Check Your PDPA Readiness for FreeThis page is general information about Sri Lanka's PDPA, not legal advice.
Need help with your website or data? Talk to MetaXell. Read how we handle your data in our privacy policy.