Cabinet endorses PDPA amendments to strengthen stakeholder alignment and regulatory capacity

The Cabinet of Ministers has approved the proposed amendments to the Personal Data Protection Act (PDPA) that would enable a change to the date of operation of the enforcement provisions in the Act amongst other changes.

Accoridngly, the original enforcement date, set for 18th March 2025, as per Extraordinary Gazette No. 2366/08 issued on 8th January 2024 would be amended to grant additional time for enforcement of this Act. 

After due consideration, the Cabinet has proposed an extension of six (06) months to the enforcement date, allowing more time to fully integrate the proposed amendments and ensure that all stakeholders are aligned and well-prepared. 

The proposed amendments to the PDPA approved by the Cabinet of Ministers would enable a change to the date of operation of the enforcement provisions in the Act. Other amendments, including Sections 17, 19, 20, 24, 26, 27, 53, and 56, drafted by the Ministry of Digital Economy in consultation with DPA and the Legal Draftsman’s Department, were also approved by the Cabinet, the Ministry of Digital Economy said. 

The government is now in the process of submitting these amendments to Parliament for approval and the Ministry of Digital Economy will publish the Amendments on its website in the near future, a statement said today.

The statement further reads: 

“Recognizing the importance of having a future ready enforcement regime, which will equally support both public and private sector adoption of digital strategies, and considering the necessity to support the establishment of a fully-fledged Regulator with capacity to meaningfully address the rights of data subjects, before the Personal Data Protection Act is brought into operation, the Cabinet of Ministers approved a Memorandum from the President, as the Minister of Digital Economy, on 19th February 2025, to amend the Personal Data Protection Act No. 9 of 2022. 

As the first-ever legislation of its kind in South Asia, the Act is a pivotal step in safeguarding citizens’ rights while being an enabler to facilitate growth and innovation in the digital economy. The amendments are designed to strengthen this landmark law, ensuring that it can be fully operationalized and embraced with greater technology choices, across all sectors of society. The proposed amendments incorporate concerns as well as valuable feedback from Government sector, private sector, and other key stakeholders in response to the Draft Rules, Draft Regulations, Draft Directives and Draft Guideline published by the Data Protection Authority (DPA). 

Many stakeholders, especially from the public sector, have expressed the need for additional time to enhance their human and technical infrastructure, enabling them to fully comply with the enforcement provisions of the Act. Some public sector institutions have suggested amendments to the Act, particularly to provide the public sector with more flexibility in making technology choices, similar to the private sector, to enable the adoption of AI Systems etc. Considering that this law would be applicable to Central Government as well as Provincial Councils, Local Authorities, Divisional Secretariats and Grama Niladhari level alike, the Government is cognizant of the need to create more capacity and therefore the need to provide additional time to ensure compliance. 

Therefore, the original enforcement date, set for 18th March 2025, as per Extraordinary Gazette No. 2366/08 issued on 8th January 2024 would be required to be amended to grant additional time for enforcement of this Act. After due consideration, the Cabinet has proposed an extension of six (06) months to the enforcement date, allowing more time to fully integrate the proposed amendments and ensure that all stakeholders are aligned and well-prepared. 

The proposed amendments to the PDPA approved by the Cabinet of Ministers would enable a change to the date of operation of the enforcement provisions in the Act. Other amendments, including Sections17, 19, 20, 24, 26, 27, 53, and 56, drafted by the Ministry of Digital Economy in consultation with DPA and the Legal Draftsman’s Department, were also approved by the Cabinet. 

The government is now in the process of submitting these amendments to Parliament for approval and the Ministry of Digital Economy will publish the Amendments on its website in the near future.”