Cabinet nod for Personal Data Protection Amendment Bill to be presented in Parliament

The Cabinet of Ministers, on 17th March 2025, has granted approval for a Memorandum from the President, as the Minister of Digital Economy, to present a Bill in Parliament amending the Personal Data Protection Act No. 9 of 2022 (PDPA). This is pursuant to Cabinet decision, dated 19th February 2025 previously announced by this Ministry, which authorized the Legal Draftsman’s Department to formulate the Personal Data Protection (Amendment) Bill.

The amendments, considered essential before the Personal Data Protection Act is brought into operation, would help embrace greater technology choices, recognizing the importance of having a future ready enforcement regime, to equally support both public and private sector adoption of digital strategies, while meaningfully addressing the rights of data subjects. The amendments also incorporate concerns as well as valuable feedback from the Government sector, private sector, and key stakeholders in response to the Draft Rules, Draft Regulations, Draft Directives and Draft Guideline published by the Data Protection Authority (DPA), while providing the public sector with more flexibility in making technology choices, similar to the private sector, to enable the adoption of AI Systems etc.

The Amendment Bill along with the “Statement of Legal Effect” will be published by this Ministry, before it is presented to Parliament.

Given that the law would be applicable to Ministries and Departments of central Government as well as Provincial Councils, Local Authorities, District and Divisional Secretariats and Grama Niladhari level alike, the Government is cognizant of the need to create more human and technical capacity to ensure compliance. Additionally, many stakeholders have expressed the need for additional time to fully comply with the enforcement provisions of the Act. Considering these requirements, the Cabinet of Ministers have decided that the enforcement date should be extended by a period not less than six (06) months, allowing more time to fully integrate with PDPA requirements and the Data Protection Authority is fully operational, while ensuring all stakeholders are properly aligned and well-prepared.

Therefore, the enforcement date originally set for 18th March 2025, as per Extraordinary Gazette No. 2366/08 issued on 8th January 2024, has been duly amended by Extraordinary Gazette No. 2427/34 issued on 14th March 2025. The new enforcement dates would be duly announced once the Amendment Bill is enacted by Parliament.

Although the Data Protection Authority would not investigate complaints, hear appeals etc. until the enforcement dates are announced, the public sector and private sector organizations processing personal data as controllers/ processors are urged to make use of this extended time period to ensure such processing activities are carried out in compliance with the provisions of PDPA, in order to build digital trust to facilitate growth and innovation in the digital economy.

Waruna Sri Dhanapala
Secretary (Actg.)
Ministry of Digital Economy