Personal Data Protection Act dates of operation announced - enforcement to commence March 18, 2025
Through an Extraordinary Gazette issued by the President as the Minister of Technology by virtue of the powers vested in him by the Personal Data Protection Act (PDPA), No. 9 of 2022 and the Constitution of the Democratic Socialist Republic of Sri Lanka, the following dates have been notified for the operationalization of the PDPA:
- December 1, 2023 as the date on which the provisions of Part VI, VIII, IX and X of the aforesaid Act shall come into operation; and
- March 18, 2025 as the date on which the provisions of part I, II, III and VII of the aforesaid Act shall come into operation.
The Part V of the Data Protection Act was brought into operation in July 2023, which enabled the President to appoint the Chairman and the Board of Directors of the Data Protection Authority (DPA). The appointments were made and subsequently announced in October 2023. The DPA serves as the Regulator for safeguarding rights of citizens related to processing of personal data by the state and private sector parties. The PDPA is also expected to be a facilitator for growth and innovation in the digital economy, as stated in its preamble of the PDPA.
As per the latest Gazette Notification, the PDPA will be fully operational and enforced, commencing 18th March 2025. Part IV of the Act, which deals with the provisions of the ‘use of personal data to disseminate solicited messages’ will be brought into operation at a subsequent date as provided for in the Act, which is not earlier than twenty-four months and not later than forty eight months from the date the Act was certified by the Speaker.
By bringing Part VI, VIII, IX and X of the aforesaid Act into operation from 1st December 2023, the Data Protection Authority is empowered to create the fund of the Authority and take steps to formulate Rules under Section 52 of the Act for the schemes of recruitment of the Director General/ key staff members, delegation of authority for the Director General and staff as well as take other operational steps to establish a fully functional Authority to implement the PDPA effectively. This will enable the DPA to recruit and appoint a Director General and key staff, through an open, transparent and competitive process, create the institutional infrastructure and capacity, and create awareness among key stakeholders before enforcing the Act commencing 18th March 2025.
The DPA expects to formulate the policy framework and the Rules and Regulations to enforce the Act, using a consultative approach, during the 2nd and 3rd quarters of 2024 and create awareness of these policies, rules and regulations during the 4th quarter of 2024 and 1st quarter of 2025.