Sri Lanka’s PDPA Takes Effect January 1, 2027: What Global Enterprises Need to Know

Sri Lanka made history in March 2022 when it became the first country in South Asia to pass a comprehensive data protection law. The Personal Data Protection Act, No. 9 of 2022 (PDPA) established a Data Protection Authority, defined penalties of up to LKR 10 million per violation, and borrowed heavily from the playbook that …