Skip to main content

    AI by country · South Asia

    AI in Sri Lanka: the rules, the readiness and where to start

    Last checked: 26 October 2026

    What should a company in Sri Lanka know before starting with AI?

    Sri Lanka has no dedicated AI law and, as of 26 October 2026, we found no final national AI policy. The rule that matters now is the Personal Data Protection Act, No. 9 of 2022, whose core duties for controllers and processors start on 1 January 2027. A company starting with AI has a few months to map its data and fix its contracts.

    At a glance

    Sri Lanka at a glance

    Key facts about Sri Lanka
    Data protection lawPersonal Data Protection Act, No. 9 of 2022. Phased: core duties from 1 January 2027
    RegulatorData Protection Authority of Sri Lanka (DPA)
    AI policyNo dedicated AI law as of 26 October 2026. A national AI policy went to public consultation in early 2025; no final version found
    Time zoneUTC+5:30 (same as India)
    CurrencyLKR
    Business languageEnglish, Sinhala, Tamil

    Why now

    Why Sri Lanka is worth watching

    Each point links to the document it comes from.

    • The Office of the Chief Advisor to the President on Digital Economy has set a goal of growing the digital economy from about US$3 billion to US$15 billion, and officials say the US$5 billion IT revenue target for 2030 needs faster AI adoption.[5]

    • Official figures put ICT and business process management exports at US$1,645 million in 2025, up 8.8 percent, though the industry body says this understates the real value.[8]

    • Apparel and textiles were the top merchandise export in 2025 at US$4.91 billion, up 5.34 percent, and the Export Development Board projects US$5.5 billion for 2026.[9]

    • Tourism is recovering: 1,923,502 visitors had arrived by 5 November 2025, with India the largest source market.[10]

    • State universities launched an AI policy framework in May 2026, and the Prime Minister said policy and governance must keep pace with AI.[7]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Act, No. 9 of 2022: core duties

    Phased2022A gazette dated 22 July 2026 sets 1 January 2027 for sections 2 and 3, Part I (processing of personal data) and Part III (controllers and processors). Part III covers data protection officers, breach notification, impact assessments and cross-border processing. The Act reaches organisations that offer goods or services to people in Sri Lanka, so a foreign company serving Sri Lankan customers can be covered.[1]

    PDPA cross-border processing and automated decisions

    Phased2022Section 26 limits processing outside Sri Lanka. Public authorities must keep processing inside the country unless the DPA permits listed categories. Other organisations may use a country the Minister has approved, adopt instruments the DPA specifies, or in some cases rely on explicit consent. Section 18 lets people ask for review of a decision based solely on automated processing with an irreversible and continuous impact. That right sits in Part II, which is not yet in force.[2]

    PDPA Part II (rights) and Part VII (penalties)

    Passed, not yet in force2022The 22 July 2026 gazette leaves out Part II, so rights to access, correct and erase data are not yet enforceable. Law firm commentary in the Daily Mirror says Part VII penalties are also deferred, so the DPA cannot impose administrative penalties from 1 January 2027. It can still inquire into non-compliance and issue directives. In the 2022 text, the penalty ceiling is 10 million rupees per failure to follow a directive. No start dates for either part were announced as of 26 October 2026.[4]

    DPA circulars and draft regulations

    Draft2026The DPA lists Circular No. 01/2026 on the PDPA in the public sector, dated 7 August 2026. It also lists draft rules from October 2024 on breach notification, impact assessments, data protection officers and transfers outside Sri Lanka. Drafts can change, so treat them as a guide only.[3]

    Where AI fits first

    Where AI fits first

    Apparel and textiles

    Demand forecasting, fabric defect checks from photos, and reading buyer purchase orders and specification sheets.

    Exports fell 2.82 percent year on year in January 2026, mainly from lower shipments to the US and EU. Worker and supplier details become personal data covered by the PDPA once Part I and III apply.[9]

    Banking and finance

    Customer service in Sinhala and Tamil, document checking for loans, and fraud alerts.

    The Central Bank Governor said in September 2025 that AI brings risks such as privacy problems and bias and needs governance. That was a speech. We found no Central Bank AI rule.[11]

    Tourism

    Multilingual guest messaging, review summaries and booking support for hotels and tour operators.

    Guests come from India, the UK, Russia, Germany and China, so data moves across borders and the PDPA transfer rules matter.[10]

    IT and business process services

    Code and test assistance, document processing and support automation for overseas clients.

    Firms that handle client data as processors will have contract duties under Part III from 1 January 2027.[8]

    Your first steps

    Your first steps

    1. List every system that holds personal data of customers, staff or guests, and mark which ones you want to connect to an AI tool.
    2. Check whether your AI vendor processes data outside Sri Lanka, and note which transfer route under section 26 you would rely on.
    3. Decide who will act as your data protection officer, and read the DPA's draft regulation on that role.
    4. Update contracts with vendors and AI providers so processor duties are written down before 1 January 2027.
    5. Plan a breach response: who reports to the DPA, and how fast. The timing will be set by rules, so watch for the final version.
    6. Start with one low-risk use case, such as internal document search, and keep a human reviewing any decision about a person.

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Sri Lanka and India are both UTC+5:30, so the offset is zero and all Indian working hours overlap with yours. For example, 9:30 to 18:30 IST is 9:30 to 18:30 in Colombo.

    Questions

    Common questions about AI in Sri Lanka

    Does the data protection law apply to us already?

    Not fully. The core duties in Part I and Part III start on 1 January 2027 under a gazette dated 22 July 2026. Part II (individual rights) and Part VII (penalties) had no start date as of 26 October 2026.

    Is there an AI law in Sri Lanka?

    No dedicated AI law exists as of 26 October 2026. A national AI policy was put out for public comment in early 2025, and a committee was to prepare a final draft. We found no final approved version.

    Can we use a cloud AI tool hosted abroad?

    A private company can, if it meets section 26: an approved country, DPA-specified safeguards, or in some cases explicit consent. Public authorities face a stricter rule that keeps processing inside Sri Lanka unless the DPA allows it.

    Who enforces the Act?

    The Data Protection Authority, whose Part V has been in operation since July 2023. From 1 January 2027 it can look into breaches of Part I and III and issue directives, but administrative fines wait for Part VII to start.

    Free tools

    Try these first

    Three free tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 26 October 2026. Numbers in square brackets above match this list.
    1. [1] Government of Sri Lanka, hosted by the Data Protection Authority, 2026-07-22. Extraordinary Gazette No. 2498/16: Order under section 1(3), Personal D…(dpa.gov.lk)
      Full title and what we used it for

      Extraordinary Gazette No. 2498/16: Order under section 1(3), Personal Data Protection Act. Primary source. Text read in full: 1 January 2027 for sections 2, 3, Part I and Part III only.

    2. [2] Parliament of Sri Lanka, hosted by the Data Protection Authority, 2022-03-19. Personal Data Protection Act, No. 9 of 2022 (English)(dpa.gov.lk)
      Full title and what we used it for

      Personal Data Protection Act, No. 9 of 2022 (English). Primary source, 2022 text. Used for scope and sections 18, 20, 23, 24, 26 and 38. The 2025 amendment text was not read.

    3. [3] Data Protection Authority of Sri Lanka, 2026-10-26. Guidelines, circulars and gazettes page(dpa.gov.lk)
      Full title and what we used it for

      Guidelines, circulars and gazettes page. Primary source. Used for the titles and dates of Circular 01/2026 and the October 2024 drafts. Page checked on this date; the documents themselves were not read.

    4. [4] Daily Mirror, 2026-07-27. Legal experts flag unique compliance landscape in staggered PDPA rollout(dailymirror.lk)
      Full title and what we used it for

      Legal experts flag unique compliance landscape in staggered PDPA rollout. Secondary, law firm commentary. Used for the status of Part II, Part V and Part VII.

    5. [5] Sunday Times (Sri Lanka), 2026-08-09. Rapid amplification of key decisions required to be competitive in glob…(sundaytimes.lk)
      Full title and what we used it for

      Rapid amplification of key decisions required to be competitive in global AI landscape. News report on Sri Lanka AI Week 2026. Used for the US$3 billion to US$15 billion goal and the 2030 IT revenue target.

    6. [6] The Morning, 2025-01-10. Sri Lanka commences plans to prepare national policy on AI(themorning.lk)
      Full title and what we used it for

      Sri Lanka commences plans to prepare national policy on AI. News report. Used for the early 2025 consultation on a national AI policy and the committee preparing the final draft.

    7. [7] Ada Derana, 2026-05-09. Sri Lanka must shape AI future through ethics, policy and inclusive gov…(adaderana.lk)
      Full title and what we used it for

      Sri Lanka must shape AI future through ethics, policy and inclusive governance: PM. News report on the 8 May 2026 launch of the state university AI policy framework.

    8. [8] EconomyNext, 2026-02-08. Sri Lanka's IT/BPO export revenue lower than reality after crisis: expe…(economynext.com)
      Full title and what we used it for

      Sri Lanka's IT/BPO export revenue lower than reality after crisis: expert. News report citing Export Development Board data for 2025 ICT and BPM exports, plus SLASSCOM comments.

    9. [9] Daily FT, 2026-02-25. Sri Lanka projects $5.5 b from apparel exports in 2026(ft.lk)
      Full title and what we used it for

      Sri Lanka projects $5.5 b from apparel exports in 2026. News report citing the Export Development Board for 2025 apparel exports and the 2026 projection.

    10. [10] Ada Derana, 2025-11-07. Sri Lanka records over 1.9 mln tourist arrivals so far in 2025(adaderana.lk)
      Full title and what we used it for

      Sri Lanka records over 1.9 mln tourist arrivals so far in 2025. News report citing Sri Lanka Tourism Development Authority data.

    11. [11] Newsfirst, 2025-09-17. CBSL Governor champions ethical tech in finance(newsfirst.lk)
      Full title and what we used it for

      CBSL Governor champions ethical tech in finance. News report of a Central Bank Governor speech. No rule or circular was announced.

    This is general information, not legal advice. Laws and start dates change, and the PDPA Part II and Part VII dates were still open on 26 October 2026. Check with a qualified Sri Lankan lawyer before you decide. Facts were checked on 26 October 2026.

    Other country guides

    Starting with AI in Sri Lanka?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score