Citing the need to establish an institutional framework for digital transformation and economic development, a press briefing on an approved Cabinet decision on 26 May noted that approval had been granted to prepare a bill to liquidate the existing Information and Communication Technology Agency of Sri Lanka (ICTA) in order to establish the Digital Economy Authority.
Three months on and Sri Lanka is yet to publish a bill that mandates the liquidation of the ICTA.
The Cabinet decision further added: “Taking these matters into consideration, the proposal made by the President in his capacity as the Minister of Digital Economy, to establish a State-owned company named ‘GovTech (Pvt) Ltd.’ as an independent institution with the necessary authorities, enabling the smooth implementation of digital transformation projects, has been initiated.”
Publicly, the present administration maintains that the creation of two entities is meant to accelerate and streamline the implementation of digital transformation projects across the public sector. Earlier this year, Minister of Health and Mass Media Nalinda Jayatissa said that the State-owned company GovTech was to be established as part of the ICTA’s restructuring.
From what can be gauged from the statements and decisions made public this year, the proposed Digital Economy Authority will be empowered to formulate policy, while GovTech is to act as an authority that oversees the implementation of projects relevant to the digital economy.
Although the decision to wind down the institution has been long anticipated, it is yet to be realised, and the incumbent Government’s aims to transition are new and continue to remain somewhat vague. In 2022, during his 2023 Budget speech, former President Ranil Wickremesinghe as the Minister of Finance proposed that the ICTA be abolished since it had “completed its role”.
The previous Government however stated that the institution was to be replaced with a single entity, named the Digital Transformation Agency, which was to be established under a proposed Technology Promotion Act at the time, which has also since been passed up by the incumbent Government in favour for its own proposed legislative frameworks.
ICTA’s future
Cybersecurity expert Asela Waidyalankara, speaking on behalf of his own engagements with the ICTA, told The Sunday Morning Business that the existence of the agency in itself had been beneficial to the broader local ICT and technology industry.
Speaking on the formation of the agency, he stated: “This was suggested by the World Bank and it is nice to see the continuation of this agency despite a change in government. The ICTA was started in the early 2000s and existed to deliver certain projects, and it was meant to be sunsetted. Subsequently, this sunset clause was removed under President Mahinda Rajapaksa and this institution continued to exist.”
Although initially established and operationalised to carry out a World Bank project between 2004 and 2011 – following a 2008 amendment of a sunset clause of the ICTA under the Information and Communication Technology Act No.27 of 2003 – the institution has since been a permanent body within Sri Lanka’s institutional framework, overseeing the nation’s ICT development.
Speaking to The Sunday Morning Business, Media Secretary to the Deputy Minister of Digital Economy Nipuni Rajapaksha said that she had not been authorised at present regarding any information relevant to the transition that could be revealed to the public. “We still haven’t been updated on what can be shared with the public, but what I can say is that it is ongoing and is seeing progress within the agency,” she said.
Rajapaksha further declined to reveal a phased timeline of liquidation that the institution may be following.
Solving the identity crisis
Waidyalankara, expanding on his experience in witnessing developments within the industry in the past two decades, said that the agency faced an “identity crisis” at present.
“The problem is that it has an identity crisis. Is it a project agency? Is it a policy agency? Is it both or two different things? This is the identity crisis that’s taking place. This identity crisis is to be solved by breaking it into two: one to look after policy matters and one as a private limited company with 100% ownership by the Treasury, whereby implementation of projects can be driven,” he said, further supporting the proposed move to separate policy formation and implementation into two processes.
“Questions relating to where policy comes from, where thinking comes from, and where the projects come from should have been addressed a decade ago. This opens up the possibility of addressing the fact that the tech ecosystem is not engaged well. We still buy software the same way we procure ceiling fans. These are two completely different things, but the procurement processes are the same, and therefore, it stifles implementation.”
More cautiously, Waidyalankara added that another challenge the agency faced was the ability to retain the most competent tech talent, with the limitation of being a Government agency.
“Moreover, there is the factor of talent: you can’t keep talent on a Government salary scale. If you really want a tech-driven agency, you can’t keep such people on a Government salary. You have to be willing to pay them something similar to what the industry is paying them. Paying a senior software developer Rs. 1 million is fairly standard, but if you try to meet this standard in a Government setup, it is likely to trigger many issues. Obviously, it’s more than what a Government secretary or a very senior individual gets.”
Addressing the separation of the entity’s functions into two, Waidyalankara noted: “Once the identity crisis portion is removed, policy will be set by one body, whereas another can oversee things such as who is going to run the Sri Lanka Unique Digital Identity (SLUDI).”
Cautious optimism
According to Chief Adviser to the President on Digital Economy Hans Wijayasuriya, who spoke at a press conference held earlier in August, the SLUDI is to begin its data collection in January 2026 and roll out its first implementations in late February of the same year.
“I would assume this would be the implementation agency, whereas things like policy matters, governance matters, and controls have to come from the policy agency. Hopefully, it will be done logically,” Waidyalankara said.
However, he noted that Sri Lanka needed to exercise a level of cautious optimism. “History has not been kind to us. There are plenty of times when we have implemented agencies of this kind in good faith but have fallen short. If you take the Data Protection Authority (DPA), despite the high hopes for it, it is still in the formation stages.”
Sri Lanka is yet to operationalise its DPA due to pushback on implementing the Personal Data Protection Act No.9 of 2022 as a result of amendments being enacted in relation to the act. The authority is set to resume operations by March or April 2026, following its closure at the end of the previous administration, according to Digital Economy Deputy Minister Eranga Weeraratne.
To gauge an understanding of the ICTA’s own view of the transition, progress, and ongoing efforts to realise the liquidation of the entity before the end of the year, The Sunday Morning Business reached out to ICTA Project Manager – Strategic Communications Maleen Danushka, who stated that the agency was unable to divulge any further information.
Attempts to contact ICTA Acting CEO Sanjaya Karunasena proved futile.