From 1 January 2027
In forceWhat's in force from 1 January
Lawful basis for every usePurpose limitsRetention limitsVendor contractsBreach notificationImpact assessmentsData Protection Management Programme
Sri Lanka · PDPA in force 1 January 2027Your teams are using AI.
Your teams are using AI.
Most of that AI is a PDPA problem
Parts I and III of the Personal Data Protection Act take effect on 1 January 2027. If your organisation uses AI tools, and it does, you have 47 days to know where you stand.
No legal advice. No scare tactics. A clear view of where your AI use is exposed, and what to do about it.
PDPA briefing, episode 1: Is this a breach? · 66 seconds
The clock
The obligations start on day one. So does the clock.
–Days
–Hours
–Minutes
There are no exemptions for small businesses.
- 01
1 Jan 2027
Parts I and III of the Act come into force.
- 02
LKR 10M
Per violation, once the fines section starts.
- 03
Section 38(6)
Personal liability for directors without due diligence.
The nuance
“No fines yet” is a trap.
When Parts I and III come into force in January, the Data Protection Authority can investigate, issue directions and order compensation from day one. The fines section is still awaiting a Gazette order, but the obligations are already law.
When the fines part starts, directors become personally liable unless they can demonstrate due diligence. “We didn't know” isn't due diligence.
Next
ComingWhat's coming next
Access, correct and erase dataChallenge automated decisionsConsent for marketing SMS, email and WhatsAppWhen the fines section starts
Gazette pendingFines and director liability
LKR 10M per violationDirectors personally liable
What it means for AI
Every AI tool your teams use is a data processor.
Every automation that moves personal data is a data flow.
Every AI decision that affects a person is potentially subject to review.
The AI angle
Shadow AI is breaking PDPA rules right now. Most organisations don't know it.
When someone on your team pastes a client contract into a free chatbot, three things happen at once.
Your team
client_contract.pdf
Free chatbot
Personal login, free tier
Overseas servers
Outside Sri Lanka
- 1New purposeBreach
The data is used for a new purpose, with no lawful basis under Part I.
- 2New vendorBreach
It's handed to a vendor, with no contract as required by sections 21 and 22.
- 3New countryBreach
It's sent overseas, with no cross-border transfer safeguard under section 26.
And none of it is in your Management Programme, which section 12 requires you to maintain.
This isn't hypothetical. It's happening in every Sri Lankan organisation that uses AI tools without a governance framework, which is most of them.
Free chatbots
ChatGPT, Gemini, Claude free tier
Personal data pasted in means a purpose breach, a vendor contract breach and an overseas transfer without safeguards.
PurposeVendorTransfer
AI automations
Make, Zapier, n8n
Every workflow that moves customer or employee data through a third-party tool is a vendor data-processing relationship that needs a written contract.
Vendor contract
AI CV screening or credit decisions
Any AI that decides about people
Once Part II is in force, people can demand a human review of any purely automated decision. Impact assessments are required from January.
Impact assessmentHuman review
Microsoft Copilot or Google Workspace AI
Enterprise AI inside your tools
Safer than free tools, but only if data classification is set up correctly and employees know what can and can't go in.
Depends on set-up
The standard
You don't stop using AI. You use it in a way that holds up.
PDPA compliance for AI isn't about restricting what your teams can do. It's about knowing what they're doing, with whose data, through which tools, and being able to demonstrate that.
Three things every organisation needs by January
01
An AI use register
Every AI tool in use, by which team, for what purpose, with what personal data, stored where. This feeds directly into your section 12 Management Programme.
Covers
ToolTeamPurposePersonal dataStorage location
02
Vendor contracts for AI tools
Any tool that processes personal data on your behalf needs a written data processing agreement. Most free tools don't offer one, which means they can't be used with personal data at all.
Covers
A DPA per toolFree tools kept off personal data
03
A clear acceptable use policy
What your teams can and can't do with AI, with whose data, using which approved tools. Without it, you can't demonstrate that a breach wasn't authorised.
Covers
Approved toolsWhat can go inWhose data
FreeAbout five minutesNo sales call
Know where you stand before January.
The PDPA AI Readiness Check maps your organisation's current AI use against the six areas the PDPA needs covered by 1 January. You'll finish with a scored report showing where you're exposed and what needs to happen first, on screen and by email.
- Shadow AI · tools moving personal data without safeguards
- Vendor contracts · data processing agreements in place
- AI use register · a record of what each tool uses
- Acceptable use policy · teams know what they can and can't do
- Cross-border transfers · personal data going overseas
- Automated decisions · AI shaping decisions about people
Start the check No spam. We'll follow up only if you ask us to.
Sample report
Ceylon Logistics
Exposed
30% PDPA-ready
- Shadow AI33%
- Vendor contracts50%
- AI use register17%
- Acceptable use policy33%
- Cross-border transfers17%
- Automated decisions33%
1
Do first
AI use register
Where we come in
We're not lawyers. We're the people who make the framework work
Delta Camp is an AI governance and implementation partner. We don't give legal advice. We work alongside your legal counsel to build the AI governance structures the PDPA requires in practice.
Team workshops
One dayResponsible AI at Work
The safe alternative to shadow AI is approved tools that keep data inside your systems, and teams that know how to use them. The workshop covers what your teams can and can't do, on the tools you actually have: Microsoft Copilot, Google Workspace or approved alternatives.
Best for: For organisations whose biggest gap is how people use AI day to day.
Before the deadline
Two weeksPDPA × AI Readiness Assessment
A full diagnostic: a shadow AI scan, data flow mapping across your AI tools, a vendor contract review and a cross-border transfer audit, delivered as a board-ready gap report before 1 January.
Best for: For organisations that want a clear picture before the deadline, without committing to a full governance engagement.
Fractional CAIO
90 daysAI Governance Framework
Delta Camp goes in as a fractional Chief AI Officer and builds the full governance structure: AI use register, acceptable use policy, vendor contract framework, impact assessment process, cross-border transfer protocol and board briefing, then hands it to your team to run.
Best for: For organisations that want AI governance to be a board-level asset, not a compliance exercise.
Built on Delta Camp's AI Governance Starter Kit, used by organisations in Sri Lanka, Malaysia, Singapore and Australia.
70+ teams trained and AI-enabled in 12 weeks
Real Transformation. Real Results Delivered.
“He moved us from isolated AI experimentation to a structured and scalable roll-out across the business. The workshops he delivered for our team were extremely impactful — and his focus on execution, not just ideas,is what sets him apart.”
Keshia Bari, COO
AI adoption & Microsoft Copilot roll-out to a finance consultancy from 🇦🇺
Personal Data Protection Act No. 9 of 2022 · Amendment Act No. 22 of 2025 · Gazette No. 2498/16 (22 July 2026) · Parts I and III in force 1 January 2027
Questions
Straight answers.
The things leadership teams ask before they take the check or book a call.
Is Delta Camp a law firm?
No. We're an AI governance and implementation partner. We build the operational structures the PDPA requires, such as use registers, policies and vendor frameworks, and work alongside your legal counsel for sign-off. We don't give legal advice.
Does PDPA apply to my company? We're small.
Yes. There is no size exemption in the Personal Data Protection Act. If your organisation processes personal data in Sri Lanka, the Act applies.
We use Microsoft 365. Are we already compliant?
Not automatically. Microsoft 365 has the right data processing agreements in place, but whether your organisation is compliant depends on how your teams use the tools. AI features, data classification settings and your internal policies all matter.
What's the difference between the free check and the paid assessment?
The free check is a self-assessment: you answer the questions and get a scored report. The paid assessment involves Delta Camp reviewing your actual tools, workflows and vendor contracts, and producing a board-ready gap report.
Can you help us implement the changes, not just identify them?
Yes. That's the Fractional CAIO engagement and the team workshops. The check and the assessment tell you where you are. The implementation work gets you to where you need to be.
Before 1 January 2027
1 January 2027 is 47 days away.
30 minutes
Talk to us
A 30-minute call about where your organisation is and what needs to happen. No pitch, and no proposal until you ask for one.