Sri Lanka's Personal Data Protection Act — compliance for in-house counsel.

Sri Lanka's Personal Data Protection Act is now fully in force, and the Data Protection Authority's early enforcement pattern gives in-house counsel a clear picture of what compliance requires in practice.

The Act's principal obligations will be familiar from other modern regimes: lawful bases for processing, purpose limitation, data-subject rights, breach notification, and — for controllers meeting the thresholds — the appointment of a data protection officer.

The provisions with the most operational bite are those on cross-border transfer. Transfers require an adequacy determination, appropriate safeguards, or a statutory derogation; groups that centralise HR or customer data abroad should map those flows and document the basis for each.

Processing agreements deserve early attention. Controllers remain responsible for their processors, and the Act expects that responsibility to be contracted for. Standard vendor terms drafted for other jurisdictions rarely satisfy the Sri Lankan provisions without amendment.

The firm's IT practice advises controllers and processors on PDPA compliance programmes, data-processing agreements, breach response, and dealings with the Authority.