Starting your PDPA programme: a practical guide
Sri Lanka's Personal Data Protection Act asks organisations to handle personal data deliberately. Here is a practical way to begin.
Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), sets out how organisations should collect, use, share and keep personal data. This article offers a practical way to start. It is not legal advice, so involve your legal counsel for interpretation.
1. Understand what you hold
Begin by listing the personal data your organisation processes: customers, employees, job applicants, suppliers and website visitors. For each, note why you process it, who is responsible and where it is stored.
2. Assign ownership
Compliance is a team effort. Name an owner for each processing activity and a person or function accountable for the programme as a whole.
3. Review how consent is used
Where you rely on consent, check that it is specific, recorded and can be withdrawn. Where you rely on other grounds, document them.
4. Close the gaps
Turn your findings into actions with owners and due dates. Prioritise those that affect individuals most.
5. Make it repeatable
A one-off exercise decays quickly. Choose a way to keep registers, actions and reports current, whether through disciplined spreadsheets or a platform such as TrustLayer.
If you would like to talk through where to start, book a consultation.
