New enforcement date for PDPA by April

• Original timelines no longer applicable in light of amendments
• Comprehensive rollout plan to be formulated first
• Dimuth Atapattu appointed as Director General of DPA Secretariat

A new enforcement date for the Personal Data Protection Act (PDPA) No.9 of 2022 is likely to be determined by the end of March following the appointment of Dimuth Atapattu as Director General of the Data Protection Authority (DPA) Secretariat, the Ministry of Digital Economy has indicated.

Speaking to The Sunday Morning Business, Ministry of Digital Economy Secretary Waruna Sri Dhanapala stated that the original timelines for enforcing obligations under the act were no longer applicable following the amendments introduced by the Personal Data Protection (Amendment) Act No.22 of 2025.

Under the original framework of the 2022 act, most provisions of the PDPA were scheduled to come into operation on 18 March 2025, as per Extraordinary Gazette No.2366/08, issued on 8 January 2024. This deadline was later extended by six months through Extraordinary Gazette No.2427/34, issued on 14 March 2025.

Dhanapala explained that following the amendment, new guidelines must be issued before the act could be enforced.

“An amendment was made to the PDPA and new guidelines will need to be introduced. There will be a new Director General from Friday (6). He will have to fast-track several aspects of implementation, including issuing instructions to Government institutions,” he said.

Accordingly, he revealed that Atapattu had been appointed as Director General of the DPA Secretariat with effect from Friday. Atapattu is expected to spearhead the drafting of new guidelines, which will require approval by the DPA Board. 

Dhanapala noted that a comprehensive rollout plan must first be formulated, after which a new enforcement date would be determined. He added that a decision on the revised enforcement timeline was expected within the month.

Under the original Section 1 of the 2022 act, most provisions, excluding Parts IV and V, were required to come into force between 18 and 36 months from the date of the Speaker’s certificate. Part IV was to come into operation between 24 and 48 months, while Part V was to take effect no later than the date specified for the other provisions.

However, the 2025 Amendment Act repealed these fixed timelines and instead granted the minister discretion to bring all provisions of the act, other than Section 1, into operation on such date or dates as he may appoint by order published in the gazette.

Source: The morning