We only have a handful of employees. Do we still need the full PDPA apparatus?

PDPA obligations are not waived automatically according to headcount. The basic actions — processing records, notices, retention periods — apply as soon as you process personal data. Whether a DPO must be appointed depends on whether your activities amount to large-scale processing of special categories of data, systematic monitoring, or a statutory high-risk situation under Section 20. That judgement is best made by a licensed professional firm rather than self-assessed.

Does uploading Sri Lankan payroll data to our group head-office system count as a cross-border transfer?

Yes. Once data leaves Sri Lanka, the Section 26 cross-border rules apply, and you need either a safeguard mechanism recognised under DPA directives or a statutory exception. Start with a field-level transfer list, marking which fields genuinely need to go overseas and which can stay local, then have a professional firm draft the clauses on that basis.

What do clients usually ask for during supplier due diligence?

Typically the processing inventory, the two privacy notices for staff and customers, consent records (especially for sensitive data and data of children under 16), the cross-border transfer basis, the rights request log, and the breach response process. What matters is not the thickness of the file but whether every processing activity maps to a record.

How quickly must a data breach be reported, and how prepared does the internal process need to be?

Under the DPA's draft rules, a breach must be reported to the DPA within 72 hours; the rules as formally published by the DPA govern. To function inside that 72-hour window, decide in advance who assesses whether an incident is a reportable breach, who is authorised to communicate externally, and who logs the timestamps — and rehearse it at least once before your systems go live.

Tax

Sri Lanka PDPA: What to Put in Place Before Processing Employee and Customer Data

MMD Team · Updated October 13, 2026

Before you process employee or customer data in Sri Lanka, four things have to exist: a record of processing activities, a Data Protection Management Programme (DPMP), two separate privacy notices (one for staff, one for customers), and a lawful basis for every cross-border transfer. The governing law is the Personal Data Protection Act No. 9 of 2022 (PDPA), as amended by Act No. 22 of 2025, with the Data Protection Authority (DPA) as regulator. Core entity obligations become mandatory on 1 January 2027.

If you are building a delivery team in Sri Lanka, the terms "data protection", "cross-border transfer" and "DPO" are probably already showing up in client due-diligence questionnaires. You have a dozen people, your systems are still half-sorted, and it is tempting to park the whole file for later. The problem: PDPA duties are triggered by what you process, not by how big you are — and the first data you handle is usually local staff data, meaning NIC numbers, EPF records and payroll files.

What do you need in place before you process data?

Order matters: records first, notices second, systems last. Most teams do it the other way round — an overseas HR system goes live, paperwork is chased afterwards, and only then does someone notice that certain fields should never have left the country.

Run a processing inventory. List every category of data you collect. On the employee side: NIC numbers, TIN, EPF/ETF account numbers, bank details and medical records. On the customer side: contact details, contracts and transaction records. For each category, set down why you collect it, the legal basis, the retention period, and who can see it — including an overseas parent company, cloud providers and outsourced vendors.
Turn the inventory into a written programme. The inventory is the raw material; the DPMP is the system: who is accountable, how often it is reviewed, what happens to data after an employee leaves, and the process followed when a customer asks for deletion. The DPA has consulted publicly on DPMP guidance, so follow the latest text the DPA publishes rather than an older template.
Decide whether a Data Protection Officer (DPO) is mandatory. Section 20 is triggered where core activities involve large-scale processing of special categories of data (health, biometrics, criminal records), systematic monitoring, or a statutory high-risk situation. A DPO can be an internal staff member or an external appointment; once named, the contact details must be published and the appointment notified to the DPA. Whether your processing counts as "large-scale" is not a judgement to make informally — have a licensed professional firm reach that conclusion.
Prepare two sets of notices. Purpose, legal basis, recipients and cross-border flows must be disclosed before collection begins. Data relating to children under 16 and sensitive personal data require explicit consent — explicit, not a pre-ticked box buried in an onboarding pack.
Establish a basis for cross-border transfers. The moment local data is uploaded to a parent company system or an overseas cloud, Section 26 (as amended in 2025) applies. The lawful routes are either a safeguard mechanism recognised under DPA directives, or a statutory exception such as processing necessary for the performance of an employment contract. The DPA has issued draft directives on cross-border transfer tools; the text formally published by the DPA governs.
Set your response clocks now. Access, correction and deletion requests from employees or customers should in principle be answered within 21 working days or one month, and within three months at the outside for complex cases. Under the DPA's draft rules, a data breach must be reported to the DPA within 72 hours. Both clocks assume you already have a log and an incident plan — not that you start drafting one on the day it happens.

Specific legal conclusions should come from a licensed professional firm. A business support provider typically handles the layer around that: coordinating the document list, instructing the professionals and tracking progress.

Where do the time and cost actually go?

Three buckets. Internal review hours — HR and IT time, the most consistently underestimated item. External professional advice — the DPMP text, cross-border transfer clauses, and the assessment of whether a DPO is mandatory. And tooling for records and access permissions. The first two are professional-service quotes; the third is a procurement quote. Ask for a line-item breakdown by workstream and decline a single "data compliance package price" — if you cannot tell which part is advisory and which part produces a signed document, you will struggle to sign it off later.

Which misunderstandings cause the most rework?

Myth 1: A translated global privacy policy is enough

What people assume: the group already has a global privacy policy, so translating it and posting it on the intranet covers the requirement.

What is actually the case: two features of the PDPA are absent from many other jurisdictions. Data of deceased persons is protected, and legal heirs may exercise rights for up to 10 years after death. Data of children under 16 carries its own compliance threshold. A global template with no local adaptation is usually sent back during client due diligence or audit.

What it costs you: it is not a wording fix. Notices have to be reissued, consent records re-signed, and the legal basis for historical data re-confirmed — effectively rerunning onboarding.

Myth 2: Employee data falls outside data protection law

What people assume: the PDPA is about customers and consumers; internal personnel files do not count.

What is actually the case: a local employee's NIC, EPF file, bank statements and medical records are all protected personal data, and this is the riskiest territory you have — HR collects, forwards and files it every day. Sri Lankan employment also generates personal data through statutory registrations: an employer must complete EPF registration after hiring its first employee, subject to the Department of Labour's latest requirements (https://labourdept.gov.lk/), and the flow of that data needs to be documented too.

What it costs you: employee complaints and DPA enquiries tend to land on HR first, and when a client audits you, what they examine is precisely whether employee data has a consent basis and a retention period.

Myth 3: Uploading staff into an overseas HR system is just an internal matter

What people assume: sending data to the group's head-office system is "internal use" and has nothing to do with cross-border transfer.

What is actually the case: once data leaves Sri Lanka, Section 26 cross-border rules apply. Without a safeguard mechanism recognised by the DPA, and without falling into a statutory exception, that upload is itself a breach.

What it costs you: amending the contract is only step one. You also need to re-decide which fields stay local and which roles can access them, and for payroll, tax numbers and identity documents that usually means reconfiguring the system. Related to this: the TIN and PIN authorisation structure determines who can touch those records inside local systems, subject to the Inland Revenue Department's latest requirements (https://www.ird.gov.lk/), so permission design is best handled alongside your tax operations.

Myth 4: Nothing matters until 1 January 2027

What people assume: since core obligations are only mandatory from 1 January 2027, there is still time.

What is actually the case: three things will not wait. Clients are asking due-diligence questions now. You are processing employee data now. And drafting a DPMP and cross-border transfer text plus getting it internally approved takes months. The Amendment Act No. 22 of 2025 removed the previously fixed transitional timetable, so the commencement date for the substantive obligations is set by gazette notification — there is no automatic extension.

What it costs you: compressing preparation into the six months before commencement collides with the period when professional firms are fully booked and internal process change meets the most resistance. And once you are found non-compliant with a corrective direction from the DPA, the administrative fine runs up to LKR 10 million per instance, with repeat breaches attracting double the previous penalty.

Pre-launch checklist: which records come first?

Action	Records to keep	Who owns it
Processing inventory	Data categories, sources, purposes, retention periods, recipient list	Internal HR/IT review, checked by a professional firm
Data Protection Management Programme (DPMP)	Written programme text, internal owner, review cycle	Drafted by a licensed professional firm, signed by the company
Whether a DPO must be appointed	Assessment conclusion; if appointed, published contact details and notification to the DPA	Professional firm decides under Section 20
Employee and customer notices	Two texts, records of when each was issued, explicit consent records	HR with external advisers
Cross-border transfer basis	List of transferred fields, safeguard text or statutory exception note	Drafted by a professional firm, retained by the company
Rights request log	Request date, response date, outcome	Named internal point of contact, supported by advisers
Breach response process	Time-stamped records of detection, assessment and notification	Internal team with advisers; run one rehearsal before go-live

This article is general information only and is not legal, tax or immigration advice. Specific requirements are governed by the latest guidance from the relevant Sri Lankan authorities and the licensed professional firm you engage.

FAQ

We only have a handful of employees. Do we still need the full PDPA apparatus?: PDPA obligations are not waived automatically according to headcount. The basic actions — processing records, notices, retention periods — apply as soon as you process personal data. Whether a DPO must be appointed depends on whether your activities amount to large-scale processing of special categories of data, systematic monitoring, or a statutory high-risk situation under Section 20. That judgement is best made by a licensed professional firm rather than self-assessed.
Does uploading Sri Lankan payroll data to our group head-office system count as a cross-border transfer?: Yes. Once data leaves Sri Lanka, the Section 26 cross-border rules apply, and you need either a safeguard mechanism recognised under DPA directives or a statutory exception. Start with a field-level transfer list, marking which fields genuinely need to go overseas and which can stay local, then have a professional firm draft the clauses on that basis.
What do clients usually ask for during supplier due diligence?: Typically the processing inventory, the two privacy notices for staff and customers, consent records (especially for sensitive data and data of children under 16), the cross-border transfer basis, the rights request log, and the breach response process. What matters is not the thickness of the file but whether every processing activity maps to a record.
How quickly must a data breach be reported, and how prepared does the internal process need to be?: Under the DPA's draft rules, a breach must be reported to the DPA within 72 hours; the rules as formally published by the DPA govern. To function inside that 72-hour window, decide in advance who assesses whether an incident is a reportable breach, who is authorised to communicate externally, and who logs the timestamps — and rehearse it at least once before your systems go live.

Need this applied to your case?

Tell us your team size, industry and timeline — we will map the actual path for your project.