Deputy Minister of Digital Economy Eranga Weeraratne has acknowledged ongoing recruitment delays at Sri Lanka’s Data Protection Authority (DPA), despite its formal establishment in August 2023 and the appointment of its Chairperson and Board of Directors.
In a post shared via his official Facebook page on Tuesday (03), the Minister said the authority, set up under the Personal Data Protection Act No. 9 of 2022, is still in the process of hiring essential staff.
The full implementation of the Act, initially expected by March this year, has been postponed by six months due to gaps in infrastructure and technical expertise.
Concerns have been growing within the tech industry and civil society over the DPA’s limited functionality, with stakeholders pointing to a lack of published directives and public consultations.
Minister Weeraratne also noted that the current legislation includes “certain contradictions” when applied to emerging technologies like artificial intelligence (AI), prompting the need for amendments.
Meanwhile, Urban Development Minister Anura Karunathilaka proposed an amendment bill to parliament containing 13 revisions to the Act. The changes aim to address AI governance, strengthen data subjects’ right to erasure, and introduce investment-friendly provisions for cloud computing.
The push for digital regulation comes in the wake of a series of cybersecurity breaches in 2025, including a ransomware attack on the Sri Lanka Pensions Department’s website that exposed sensitive personal data of pensioners.
Leave a comment