Strengthening personal data protection law regime in Sri Lanka: A critical perspective

Abstract

Data is the new oil of the 21st century.’ As the foregoing metaphor illustrates data fuels the digital economy of today. The topic of personal data protection has come to the forefront of academic discourse in Sri Lanka in recent years. With the introduction of the long-awaited Personal Data Protection Act, No. 9 of 2022, Sri Lanka heralds a new era for personal data protection creating a conducive environment for businesses to operate. Viewed through the lens of its objectives, the Act is designed to protect the personal data rights of Sri Lankan citizens while fostering growth in the digital economy. However, it is a matter of concern that the Act has faced criticism over its implementation as well as loopholes in its substantive provisions. Therefore, the purpose of this research is to critique the new data protection legislation along with its implementation challenges in view of current realities in Sri Lanka. In terms of the methodological approach of this research, it dwells within the positivist black letter legal research methodology coupled with comparative legal analysis. The results of this research indicate that the enactment of this landmark legislation is a welcome step in aligning Sri Lanka with global data protection standards...