SRI LANKA Law and Practice Contributed by: Ayanthi Abeyawickrama, Varners
9. Looking Forward 9.1 Upcoming Legal Reforms
an adequate level of data protection, or where appro - priate safeguards are in place (such as standard con - tractual clauses or binding corporate rules). Data con - trollers must ensure that the rights of data subjects in Sri Lanka are not prejudiced by such transfers. 8.3 Role and Authority of the Data Protection Agency The Data Protection Authority of Sri Lanka is the inde - pendent regulatory body tasked with enforcing the country’s data protection regime. The Authority has been established and is already active in preparing the regulatory groundwork, and plays a central role in ensuring compliance with the PDPA across both public and private sectors. Its core functions include: • monitoring and ensuring compliance with the pro - visions of the PDPA; • investigating complaints, either upon receipt or on its own initiative; • conducting audits and inspections of data control - lers and processors; • issuing binding directions, codes of practice, and guidelines to promote responsible data handling; • imposing administrative penalties and requiring corrective actions in cases of non-compliance; and • overseeing data breach notifications, including the assessment of risk and response measures. The Authority is also empowered to collaborate with international regulatory bodies and issue adequacy decisions or approve cross-border transfer mecha - nisms. It acts as the primary guardian of personal data rights, ensuring that individuals’ privacy is respected and upheld in both the public and private spheres. While the provisions establishing the Authority are in force, the substantive provisions of the PDPA have been brought into operation on a phased basis. The commencement date originally scheduled for March 2025 was repealed, and, following the Personal Data Protection (Amendment) Act, No 22 of 2025, the remaining provisions (including the principal enforce - ment powers) are expected to come into full operation during 2026, after which enforcement powers will be exercised in full.
Sri Lanka is currently undergoing a significant wave of legal and institutional reforms, driven by the gov - ernment’s commitment to economic recovery, fiscal transparency and good governance, particularly in line with its obligations under the International Monetary Fund (IMF) programme. These reforms are designed to strengthen investor confidence, modernise regula - tory frameworks, and address structural weaknesses exposed by the recent economic crisis. Recent legislative initiatives have focused on: • combating bribery and corruption, with stricter enforcement and disclosure obligations; • reforming anti-money laundering (AML) laws to align with Financial Action Task Force (FATF) stand - ards; • enacting new legislation on public financial man - agement, namely the Public Financial Management Act, No 44 of 2024 and the Public Debt Manage - ment Act, No 33 of 2024, with public procurement reform to follow; • modernising revenue administration and strength - ening the independence of the Central Bank of Sri Lanka; and • enacting new laws on proceeds of crime and contract enforcement, including the digitalisation of commercial courts. In the area of tax law, recent and forthcoming changes include: • an 18% VAT on digital services supplied by non- resident providers, legislated under the Value Added Tax (Amendment) Act, No 4 of 2025, and taking effect from 1 July 2026; and • an increase in the VAT rate on financial services from 18% to 20.5%, effective 1 July 2026. A number of the reforms previously anticipated in these fields have since been enacted, including: • the Companies (Amendment) Act, No 12 of 2025 (introducing the beneficial ownership regime);
1017 CHAMBERS.COM
Powered by FlippingBook