The Data Protection Authority (DPA) has issued Personal Data Protection Circular No. 01/2026, providing guidance to Ministries, Government Departments, Provincial Councils, Local Authorities, Public Corporations, Statutory Institutions and State-Owned Enterprises (Public Authorities) for the implementation of the Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025. 

This new Circular replaces the earlier DPA Circular No. 01/2024 issued on 13th September 2024. The Circular follows the recent Extraordinary Gazette Order issued by the President on 22nd July 2026, which appoints 1 January 2027 as the date on which Sections 2 and 3, Part I (Processing of Personal Data) and Part III (Controllers and Processors) of the Personal Data Protection Act will come into operation, according to a statement issued by the Data Protection Authority. 

These provisions establish the core legal principles to be adhered to by public authorities when processing personal data of data subjects. 

The Circular provides practical guidance to public authorities on the steps they should take during the transition period for compliance with the Act, the statement said. 

These include establishing appropriate governance arrangements, appointing Data Protection Officers where required, implementing Data Protection Management Programmes, conducting personal data audits, gap assessments as well as data protection impact assessments (where applicable), strengthening institutional policies and procedures, and building staff awareness and capacity. 

It also contains a practical approach to assist institutions in commencing their compliance journey. The Data Protection Authority encourages all public sector institutions to commence implementation activities without delay so that they are adequately prepared before the relevant provisions of the Act come into force on 1 January 2027, it added. 

The Authority will issue implementing rules, regulations, directives and guidelines to support the effective implementation of Sri Lanka's personal data protection framework.