The framework
The Personal Data Protection Act No. 9 of 2022 is on the books in Sri Lanka without yet being fully enforceable, a gap between enactment and operation that defines the current compliance picture.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Personal Data Protection Act No. 9 of 2022, amended by Act No. 22 of 2025
South Asia's first comprehensive law has a working regulator but no operative duties yet. Only the Data Protection Authority and interpretation provisions are in force; the 2025 amendment (Act No. 22 of 2025) left the start of the substantive obligations to a ministerial order, and none had been made as of early 2026. GDPR-trained compliance will travel well once it lands.
Marketing and advertising
GDPR-modeled bases; consent must be demonstrable and withdrawable once the substantive provisions are brought into operation. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers abroad will need an adequate destination or safeguards, with sectoral carve-outs, once the substantive provisions start.
Enforcement and penalties
Fines up to LKR 10M per violation, escalating for repeats, once the substantive provisions start.