Data Protection Authority of Sri Lanka

What Data Protection Authority of Sri Lanka does

The Data Protection Authority of Sri Lanka (DPA) is an independent statutory regulatory body established in August 2023 under the Personal Data Protection Act No. 9 of 2022, with full enforcement powers activated on March 18, 2025. The DPA regulates the processing of personal data by both public and private sector entities operating in Sri Lanka, administering a compliance framework that includes registration, consent management, breach notification, data protection officer requirements, and data subject rights mechanisms. Its regulatory perimeter covers all data controllers and processors handling Sri Lankan residents' personal data, with enforcement tools including investigations, inquiries, and penalties under the PDPA.

The DPA's core products are legislative and regulatory instruments rather than commercial offerings: the PDPA and its 2025 Amendment Act, supplemented by a portfolio of draft regulations covering Data Protection Impact Assessments, breach notification procedures, cross-border data transfer instruments, DPO appointment requirements, data subject rights and appeals, inquiry procedures, and fee structures. The authority operates a public website (www.dpa.gov.lk) for dissemination of acts, gazettes, guidelines, and public consultation documents, and distributes regulatory communications through official Gazette notifications and circulars to government ministries. Technology infrastructure is limited to standard web operations; the DPA does not maintain proprietary technology platforms or SaaS products.

The DPA's business model is that of a government regulatory body funded through statutory regulatory fees, licensing fees for data controllers and processors, and enforcement fines under the PDPA. Revenue is not publicly disclosed, and pricing details for regulatory services remain in draft regulation. The authority operates domestically within Sri Lanka and conducts international consultations with counterparts in the U.S., Germany, and the EU for knowledge exchange and capacity building, supported by partnerships with UNDP, European Commission, World Bank, UNOPS, and CERT|CC. The Board of Directors is appointed by the President of Sri Lanka, and the Director General leads the operational Secretariat from the headquarters at the BMICH complex in Colombo 07.

Name

Data Protection Authority of Sri Lanka

Legal name

Data Protection Authority of Sri Lanka

Website

https://dpa.gov.lk

Company type

Private

Founded year

2023

Operating status

Operating

Headcount range

11–50 employees

Short description

The Data Protection Authority of Sri Lanka is a government statutory body established under the Personal Data Protection Act No. 9 of 2022 to regulate personal data processing by public and private sector entities and protect citizens' privacy rights across Sri Lanka.

Ownership category

akta.pro rank

Product category

Data Protection Regulation

NAICS

Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (92615)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

Keywords

• Data protection regulation
• Personal data privacy
• Compliance enforcement
• Regulatory oversight
• Data subject rights

Headquarters

HQ city

Colombo

HQ country

Sri Lanka

HQ region

Asia

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Others, Technology or R&D, Infrastructure, Marketing or Sales

Revenue model

1. Regulatory Fees and Fines: The DPA generates revenue through regulatory fees, licensing fees for data controllers and processors, and enforcement fines collected under the PDPA.

Distribution channels3 records

Marketing channels4 records

Core offering

The Data Protection Authority of Sri Lanka is an independent statutory regulatory body that regulates and enforces personal data protection under the Personal Data Protection Act No. 9 of 2022. It issues regulations, guidelines, and circulars covering data protection impact assessments, breach notifications, cross-border data transfers, Data Protection Officer appointments, and data subject rights, while investigating complaints and imposing penalties for non-compliance by public and private sector entities.

Product overview

The Data Protection Authority of Sri Lanka is a regulatory body established under the Personal Data Protection Act No. 9 of 2022 (PDPA), not a commercial product company. Its core 'offerings' are regulatory and legislative frameworks rather than commercial products. The DPA's portfolio consists of the PDPA and its 2025 Amendment (the primary legislation), supplemented by various draft regulations and guidelines currently in public consultation, including regulations on Data Protection Impact Assessments, Data Breach Notifications, Processing Data Outside Sri Lanka, Appointment of Data Protection Officers, Data Subjects' Rights and Appeals, Inquiry Procedures, and Fee structures. The DPA also publishes circulars such as Circular No. 01/2024 on public sector application. These regulatory instruments form the compliance framework that the DPA administers and enforces, targeting both public and private sector data controllers and processors operating within or concerning Sri Lanka.

Differentiator

Problem solved

Functional benefit

Products and services

• Personal Data Protection Act No. 9 of 2022 (PDPA) Sri Lanka's landmark legislation establishing the framework for personal data protection, regulating the processing of personal data by both public and private sector entities, and creating the Data Protection Authority as the regulatory body.
• Personal Data Protection (Amendment) Act No. 22 of 2025 Amending legislation that modifies provisions of the original PDPA, including changes to enforcement timelines and operational dates for various parts of the Act.
• Draft Regulations on Personal Data Protection Impact Assessments Draft regulations outlining requirements for conducting data protection impact assessments under Section 26(4) of the PDPA.
• Draft Rules on Personal Data Breach Notifications Draft rules establishing procedures and timelines for notifying the DPA of personal data breaches.
• Draft Directive on Specification of Instruments for Processing of Personal Data Outside Sri Lanka Draft directive specifying acceptable instruments and mechanisms for transferring personal data outside Sri Lanka under Section 26(4) of the PDPA.
• Draft Regulations on Appointment of Data Protection Officers Draft regulations under Section 20 of the PDPA specifying requirements for appointment, qualifications, and responsibilities of Data Protection Officers.
• Draft Regulations on Exercise of Data Subjects' Rights and Appeals Draft regulations establishing procedures for data subjects to exercise their rights and file appeals under the PDPA.
• Draft Regulations on Inquiry Procedure Draft regulations under Section 35 of the PDPA establishing procedures for conducting inquiries into alleged violations.
• Draft Regulation on Fees Applicable for Exercising Rights of Data Subjects Draft regulation specifying fees applicable when data subjects exercise their rights under the PDPA.
• Circular No. 01/2024 - Application of the PDPA in Public Sector Circular issued on September 13, 2024, providing guidance on application of the PDPA to public sector entities.

Segments2 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Seven partnerships are on record, tiered minor and core.

• Friedrich Naumann Foundation for Freedom (FNF) Sri LankaminorStrategic or Co-development Partner · 27 July 2024FNF Sri Lanka organized a delegation visit to Germany (July 27 - August 3, 2024) for DPA officials to learn about GDPR implementation, featuring sessions with federal and state authorities, cybersecurity experts, and business compliance discussions.
• U.S. Department of Commerce - Commercial Law Development Program (CLDP)coreStrategic or Co-development Partner · 24 June 2024CLDP organized consultations in the US (June 24-27, 2024) for DPA officials with U.S. government agencies, industry experts, IAPP, Consumer Reports, CIPL, Google, and Microsoft on personal data protection best practices.
• United Nations Development Programme (UNDP) Sri LankacoreStrategic or Co-development Partner · 1 January 2024UNDP Sri Lanka is listed as a partner on the DPA website, indicating collaboration on personal data protection initiatives and development programs in Sri Lanka.
• European CommissioncoreStrategic or Co-development Partner · 1 January 2024European Commission partnership indicated on DPA website, supporting Sri Lanka's alignment with EU data protection standards including GDPR frameworks.
• United Nations Office for Project Services (UNOPS) Sri LankaminorStrategic or Co-development Partner · 1 January 2024UNOPS Sri Lanka partnership indicated on DPA website, supporting implementation and capacity building for data protection infrastructure.
• World BankcoreStrategic or Co-development Partner · 1 January 2024World Bank partnership indicated on DPA website, supporting Sri Lanka's digital transformation and data protection framework development.
• Computer Emergency Readiness Team | Coordination Centre (CERT|CC)coreTechnology or Integration · 1 January 2024CERT|CC Sri Lanka is listed as a partner, indicating collaboration on cybersecurity and data protection coordination.

Recent moves6 records

Expansion highlights5 records

Direct peers

• CNIL (Commission Nationale de l'Informatique et des Libertés): France's independent data protection authority enforcing GDPR and French data law. Directly comparable as a national DPA with regulatory oversight, enforcement authority, and advisory functions aligned with EU standards.
• Information Commissioner's Office (UK): UK's independent data protection and information rights regulator enforcing the UK GDPR and Data Protection Act 2018. Directly comparable to the DPA Sri Lanka as an independent statutory authority administering comprehensive data protection legislation with enforcement and penalty powers.
• Data Protection Commission (Ireland): Ireland's national data protection authority enforcing GDPR. Directly comparable as an independent statutory DPA with significant cross-border enforcement activity for multinationals, mirroring the cross-border transfer remit that DPA Sri Lanka is developing.
• Office of the Australian Information Commissioner (OAIC): Australia's independent information regulator overseeing the Privacy Act and related legislation. Directly comparable as an independent statutory authority handling privacy complaints, investigations, and compliance assessments.
• Personal Data Protection Commission (Singapore): Singapore's data protection authority administering the Personal Data Protection Act. Directly comparable as a national DPA in a South/Southeast Asian jurisdiction enforcing a comprehensive PDPA-style regime.
• Office of the Privacy Commissioner of Canada: Canada's federal privacy regulator overseeing compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). Directly comparable as an independent national data protection authority with enforcement and complaint-handling functions.
• Autoridade Nacional de Proteção de Dados (ANPD, Brazil): Brazil's national data protection authority enforcing the LGPD. Directly comparable as a relatively recently established national DPA in an emerging market, sharing similar institutional development stage and enforcement build-out challenges.
• Federal Commissioner for Data Protection and Freedom of Information (BfDI, Germany): Germany's federal data protection authority supervising compliance with GDPR and BDSG. Directly comparable and a key reference point given DPA Sri Lanka's engagement with German authorities and GDPR alignment efforts.

Emerging players

• Data Protection Board of India: India's adjudicatory body under the Digital Personal Data Protection Act, 2023. Comparable as a regional South Asian data protection enforcement body under development, with potential cross-border implications for Sri Lanka given shared regional data flows.

Regional players

• Office of the Data Protection Commissioner (Kenya): Kenya's statutory data protection regulator enforcing the Data Protection Act. Comparable as a recently established African national DPA focused on building out enforcement capacity, with limited overlap given different geography but analogous institutional mandate.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat3 records

Key risks5 records

Key highlights6 records

Customer concentration

• Facebookfacebook.com/dataprotectionauthority
• LinkedInlinkedin.com/company/data-protection-authority

Revenue estimate

Valuation estimate

Number of profiles

Profiles11 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Data Protection Authority of Sri Lanka