individuals, including the imprisonment
of entertainers, while the Prevention of
Terrorism (Temporary Provisions) Act of
1979 grants the state broad and
unchecked authority to act against
perceived threats (Freedom House,
2024). These laws reflect a broader
institutional pattern of consolidating
political power under the guise of
national security, enabling state
overreach without adequate oversight.
Despite being the first South Asian
country to enact a privacy law—the
Personal Data Protection Act of 2022
(Nahra et al., 2022)—efforts to promote
a more balanced regulatory approach
have faced obstacles. Civil society
groups initially attempted to introduce a
self-regulatory Code of Practice for
Online Safety sought to ensure more
robust content moderation and
compliance standards on online
platforms developed through public
consultation and the involvement of
diverse stakeholders (Lalani &
Irugalbandara, 2024). However, after
communication and diplomacy with
technology firms fell short, the
government insisted on pushing forth
the Online Safety Act, 2024 instead,
which continues the pattern of enacting
abusive legislations. The statute has
vague terminology, lacks clear
contextual definitions, and places
interpretative power in the hands of
executive bodies with contentious
agendas.
At its core, Sri Lanka’s struggle with
digital rights is tied to deeper structural
issues, including economic instability,
public distrust in the government, and
systemic failures in addressing
gender-based violence and other forms
of discrimination. While the country has
a strong and active civil society,
perspectives on digital rights remain
fragmented, with mobilization occurring
primarily in response to pressing threats
rather than through sustained advocacy.
TABLE 5 - RELEVANT TECH-RELATED POLICIES IN SRI LANKA
Law
Personal Data
Protection Act,
2022
Online Safety Act,
2024
Description
● Sri Lanka became the first South Asian country to pass a data
protection law, modeled after the EU’s GDPR, targeting all
businesses that process data within Sri Lanka and related to
its citizens.
● Ensures data is accurate, transparent, accessible, and
provides right to erasure.
● Contains vague terms like “national security threats” and
“distress” with no legal precedent or context.
18