Sri Lanka’s Data Protection Authority (DPA) has issued Personal Data Protection Circular No. 01/2026 to guide public authorities on implementing the Personal Data Protection Act.

The circular replaces the previous 2024 circular and follows a Gazette order setting 01 January 2027, as the commencement date for key provisions of the Act.

Public authorities have been advised to begin compliance work, including appointing Data Protection Officers where required, conducting data audits and assessments, and strengthening data protection policies and staff awareness.