PDPA compliance, made simple for Sri Lankan organisations.
Sri Lanka's Personal Data Protection Act puts new duties on every organisation that handles personal data, from hospitals to online shops. Data Trust gets you ready with practical tools and a real data protection officer behind them.
✓ First consultation free ✓ Plain-language advice ✓ English, Sinhala and Tamil
What changes on 1 January 2027
From that date, the PDPA's core processing rules and the duties of controllers and processors apply. In practice, organisations will need to:
Have a lawful reason
for every use of personal data, and tell people about it clearly.
Keep data secure
with measures such as encryption, pseudonymisation and access controls.
Report breaches
to the Data Protection Authority, and assess high-risk processing in advance.
Appoint a DPO
where required, and contract properly with anyone processing data for you.
How we help
Software for the routine work, and a person for the judgement calls.
PDPA readiness check FREE
A quick check of where you stand today and what to fix first.
Gap assessment & data mapping
What personal data you hold, where it flows, and a clear action plan.
Policies & notices
Privacy notices, data protection policies and staff handbooks, written for you.
Impact assessments (DPIA)
For high-risk processing, including health, finance and IT.
Outsourced DPO
A qualified data protection officer for your organisation, monthly.
Staff training & AI governance
PDPA awareness sessions, and safe rules for using AI tools.
Who we work with
Any organisation that holds customer, patient, student or staff data.
How it works
Free first chat
20 minutes on what the PDPA means for you. No obligation.
Clear action plan
We check where you stand and list what to fix, in plain language.
Stay compliant
We help you put it in place and keep it running, month after month.
Is your organisation ready for 1 January 2027?
Your first consultation is free. Pick a time that suits you, or send us a message on WhatsApp.