Home / Topics / Privacy and data protection

Privacy and data protection

In plain words

The data protection law, called the PDPA, applies from 1 January 2027. The body that must enforce it is the Data Protection Authority. It had no staff in mid-2025, and its 2027 budget cannot be seen in the documents.

Blue tag opens the government document at that pageCalc a figure we worked outAnalysis our viewAmounts are in Rs mn unless stated. Glossary

What this tells us

The law starts before the regulator is ready

Data protection duties apply from 1 January 2027. The Data Protection Authority had filled none of its 41 approved posts in June 2025. Its 2027 budget is not visible.

Why it matters. Rights are hard to use without a body that can enforce them.

What to watch. The authority's allocation at Committee Stage.

Daily FT, 10 Aug 2026 Cadre Information of Public Sector 2025 Analysis

The platform costs about 250 times the regulator

DigiGov-SL costs Rs 43,859 mn in total. The Data Protection Authority received Rs 174 mn in 2026.

Why it matters. The systems that hold personal data are funded far ahead of the body that protects it.

What to watch. Whether the gap narrows in the final 2027 figures.

MPIP 2027-2029, p. 16 Budget Estimates 2026, p. 237

The digital ID will reach into banks and telecoms

The digital ID project plans identity checks for banking and telecom services.

Why it matters. One identity used in many places raises the cost of any breach. No published privacy impact assessment was found.

What to watch. Publication of a privacy impact assessment for the digital ID.

MPIP 2027-2029, p. 16 Analysis

The detail follows, with a source tag on every figure.

What matters

PDPA enforcement starts 1 January 2027. DPOs, breach notification, DPIAs and cross-border rules apply. Daily FT, 10 Aug 2026
Three trust laws are pending. These are the Digital Economy Bill, the Cyber Security Bill and Online Safety Act revisions. Budget Speech 2027, press-reported text, Daily Mirror The Morning, 22 Feb 2026
SLCERT cannot enforce today. The NCSOC monitors but cannot penalise. The Morning, 22 Feb 2026
SLUDI uses a foreign integrator. A foreign MSI builds it. A local MSP runs it. The Morning, 22 Feb 2026
SLUDI targets private use. It provides eKYC for banking and telecoms. MPIP 2027-2029, p. 16
Platforms dwarf regulators. DigiGov-SL costs Rs 43,859 mn in total. MPIP 2027-2029, p. 16 The DPA got Rs 174 mn in 2026. Budget Estimates 2026, p. 237

Risks and gaps

Regulator capacity risk. The DPA had no staff in June 2025. Cadre Information of Public Sector 2025 Its 2027 budget is not visible. Analysis
Rs 278 bn is unitemised. The Budget Proposals vote under Head 240 names no projects for 2027. 2027 Draft Detailed Estimate Vol I, PDF p.229, Head 240, object 2509 Digital trust items funded from it cannot be tracked. Analysis
Mandate overlap. DPA, CSRA, DEA, SLCERT and TRC mandates are not yet reconciled. Analysis
Rights concerns persist. Civil society questions the Cyber Security Bill. The Morning The ICJ seeks repeal or revision of the Online Safety Act. ICJ
AI investment precedes AI policy. An AI Centre of Excellence is funded. A national AI policy is absent. The Morning, 22 Feb 2026
SLUDI transparency is missing. No published DPIA was found. Analysis

Budget lines

Line	2026	2027	Change
DigiGov-SL (SLUDI rails, eSignIn, eLocker, GovPay, Super App, gov email, software marketplace)	1,715; 702 rev. Budget Estimates 2026, p. 237 MPIP 2027-2029, p. 16	9,486 MPIP 2027-2029, p. 16	13.5x vs rev. Calc: MPIP 2027-2029
SLUDI digital ID	2,110; 910 rev. Budget Estimates 2026, p. 237 MPIP 2027-2029, p. 16	1,500 MPIP 2027-2029, p. 16	+64.8% vs rev. Calc: MPIP 2027-2029
Data Protection Authority	174 (CONFLICT: Citizens Budget shows 70) Budget Estimates 2026, p. 237 Citizens Budget 2026	Not found; 268 projected in 2026 Budget Estimates 2026, p. 237	Unknown

Line	2026	2027	Change
Head 227 Registration of Persons (NIC, e-NIC)	4,292.5 Appropriation Bill 2026, First Schedule	3,946 Appropriation Bill 2027, First Schedule, p. 35	-8.1% Calc: Appropriation Bill 2026 Appropriation Bill 2027

Delivery status

Item	Promised in Budget 2026	Status, Nov 2026	2027 signal
PDPA and DPA operation	PDPA amended for DPA to operate Budget Speech 2026, p. 19	Gazette 2498/16 brings Parts I and III into force on 1 Jan 2027 Daily FT, 10 Aug 2026	DPA called "operational". No amount stated. Budget Speech 2027, press-reported text, Daily Mirror Delivered, under-resourced.
DPA staffing	Not stated	0 actual of 41 approved, Jun 2025 Cadre Information of Public Sector 2025	No 2027 cadre data found. At risk.
SLUDI digital ID	First card in Q3 2026 Budget Speech 2026, p. 19	Target moved to late Q3 or Q4 2026 The Morning, 22 Feb 2026	Rs 1,500 mn; still framed as a foundation MPIP 2027-2029, p. 16 Slipped.

Pattern. Systems moved. Laws did not. Analysis

Data Protection Authority 2026. Budget Estimates: Rs 174 mn. Budget Estimates 2026, p. 237 Citizens Budget: Rs 0.07 bn. Citizens Budget 2026 Use Rs 174 mn. Analysis