Are SMEs and journalists safe under Sri Lanka’s data protection and privacy regime? Lessons from the EU and UK for an effective legal framework

ABSTRACT
In the digital era, personal data has become a valuable asset across many sectors in Sri Lanka. Previously, Sri Lanka lacked proper data protection legislation before enacting
the ‘Personal Data Protection Act No. 9 of 2022’ (PDPA). However, the effectiveness
of this act remains uncertain, as it is the latest legislation, and the implementation
process is still underway. This research primarily evaluates the effectiveness of the
current legal framework governing data protection and privacy in Sri Lanka, with
particular focus on SMEs and journalistic purposes, in comparison with the EU and
the UK. The study mainly adopts a doctrinal approach, with comparative analysis
across selected jurisdictions. The findings reveal that the PDPA does not fully
conform to international standards and is not sufficiently tailored to SMEs and
journalistic purposes compared to the EU and UK data protection laws. In conclusion,
this research offers recommendations to address the challenges identified.