Sri Lanka’s Personal Data Protection Act (PDPA) amendment bill may overturn the progress made by private sector organisations to adjust to the draft directives published by the previously active Data Protection Authority (DPA), Technological Lawyer Thanuki Goonesinghe told The Daily Morning Business yesterday (28).

“With the arrival of this amendment bill, when there is no operational DPA, there is a concern that the progress made by private sector organisations, having adjusted and followed the draft guidelines published by the DPA, will be upended,” Goonesinghe said.

The PDPA was published in 2019 and later passed by the Sri Lankan Parliament on 19 March 2022. The DPA was established under the PDPA, in August 2023, to continuously monitor and regulate personal data processing and privacy.

The Act, though initially slated to be fully operational on 18 March, was pushed forward by six months by the government, citing infrastructure and expertise gaps in the public sector.

In a video published on the official YouTube channel of the Sri Lanka Parliament, Member of the Parliament D. A. Janaka Senarathna said an amendment bill with 13 amendments, was granted approval to submit to parliament on 3 June, and cited infrastructure limitations and public sector unpreparedness as reasons for the delay in implementing the Act.

 “Today, the Digital Transformation Oversight Committee approved a bill to amend the Personal Data Protection Act No. 9 of 2022,” Senarathna said.

He stated that in addition to the external setbacks, the Act in itself was inadequate, leading to challenges in implementation.

“Therefore we got approval for its amendment bill, adding 13 amendments to the Personal Data Protection Act (PDPA), No. 9 of 2022, which are appropriate for 2025.”

Commenting on the private sector, Goonesinghe said: “Companies have so far been up-to-date on the directives, in preparation for the drafts to become directives, under the guidance of the DPA. Within a few months, it is likely that the progress in adjustments made by the private sector, according to the previously published draft directives, may not be valid anymore.”

Goonesinghe said that the Sri Lanka corporate sector has increasingly been aligned with the need to follow global best practice of ‘privacy by design’. “They have begun incorporating a ‘privacy by design’ idea, and this has been increasingly becoming a part of their internal processes.”

“This new amendment bill has neither had public consultations, nor exposure to the industry. While it is going to be debated in parliament, the question is whether they have done any internal consultations?”