- Enforcement date to be announced shortly
- 6–8 months for capacity building, establishing secretariat
- Secretariat DG already recruited
The Government is planning to commence enforcement of the Personal Data Protection Act (PDPA) within one year from January 2027, according to the Secretary to the Ministry of Digital Economy.
Speaking to The Sunday Morning Business, Ministry of Digital Economy Secretary Waruna Sri Dhanapala revealed that the enforcement date for the PDPA was set to be announced shortly, with the relevant gazette notice to be issued imminently.
“The plan is to operationalise it within one year from January 2027. It will take around 6–8 months for capacity building and establishing the secretariat.
“The Director General (DG) of the secretariat has been recruited, the second-level recruitment interviews are already complete, and we are now looking at third-level recruitment,” he stated.
Dhanapala further disclosed that a Fundamental Rights application filed against him concerning the enforcement date of the PDPA had been taken up before the Supreme Court on 15 May 2025.
“The judge bench took due consideration of our limitations in making it fully operational,” he stated.
The Sunday Morning Business has reliably learnt that the Fundamental Rights Application No.SC/FR/80/2025, instituted in the public interest, was heard before a Supreme Court bench comprising Chief Justice Preethi Padman Surasena, Justice Achala Wengappuli, and Justice Sampath K.B. Wijeratne on 15 May 2025.
The Petitioner challenged the rescinding of Extraordinary Gazette No.2366/08 issued on 8 January 2024, which had sought to bring the PDPA into operation on 18 March 2025, in compliance with the original requirements under Section 1 of the 2022 act.
While the Supreme Court declined to grant leave to proceed with the action on the basis that Section 1 of the 2022 act had been amended by the 2025 amendment act, thereby regularising the failure that the Petitioner was disputing, the court nevertheless took cognisance of the Petitioner’s concerns regarding the adverse public impact of the continued delay in implementing the PDPA and directed the Respondents to take prompt steps to commence its implementation.
Dhanapala further revealed that draft regulations had been prepared but had not yet been conveyed to the ministry, adding that he was of the view that the regulations could be published by October this year.
Under the original Section 1 of the 2022 act, most provisions, excluding Parts IV and V, were required to come into force between 18 and 36 months from the date of the Speaker’s certificate. Part IV was to come into operation between 24 and 48 months, while Part V was to take effect no later than the date specified for the remaining provisions.
However, the 2025 amendment act repealed these fixed timelines and instead granted the minister discretion to bring all provisions of the act, other than Section 1, into operation on such date or dates as may be appointed by order published in the gazette.
Under the original framework, most provisions of the PDPA were scheduled to come into operation on 18 March 2025, pursuant to Extraordinary Gazette No.2366/08 issued on 8 January 2024. That deadline was subsequently extended by six months through Extraordinary Gazette No.2427/34 issued on 14 March 2025.