📈 Sri Lanka Sets Jan 1, 2027 for PDPA Enforcement

• Key Date & Scope: Key provisions of the Personal Data Protection Act (PDPA) will become fully operational on January 1, 2027, setting a strict 30-day statutory window for organisations to fulfill Data Subject Requests (DSRs). • Critical Challenges: Industry leaders at the Data Privacy and Protection Summit highlighted five major hurdles: fragmented data silos, the lack of centralised intake protocols, the "IT-only" compliance misconception, unstructured data retention, and outdated consent models. • The R.E.A.D.Y. Playbook: Experts urged businesses to establish single-intake rails, empower Data Protection Officers (DPOs), audit and map records of processing, deputise third-party vendors, and train all employees to handle statutory withdrawal rights.