Short answer: from 1 January 2027, Parts I and III of Sri Lanka's Personal Data Protection Act No. 9 of 2022 apply to every business that holds customer data, including SMS and WhatsApp marketing lists. You will need a lawful basis for each list, a documented data protection programme and clear records of how numbers were collected. The specific opt-in rule for marketing messages (Part IV) is not yet in force, but WhatsApp already requires opt-in, so build consent records now.
Updated 6 November 2026
This guide explains the law in plain language for marketing teams. It is not legal advice. For decisions about your organisation, speak to a lawyer and check the Act and Gazette text yourself.
- What starts on 1 January 2027
- What is not in force yet
- What personal data your messaging list holds
- Lawful basis and consent records
- WhatsApp opt-in rules you already have to follow
- SMS rules: the levy and the TRCSL opt-out directive
- Opt-out wording in English, Sinhala and Tamil
- A 10-step checklist before 1 January 2027
- Frequently asked questions
- Gazette Extraordinary No. 2498/16 of 22 July 2026 brings sections 2 and 3 and Parts I and III into operation on 1 January 2027.
- Part I covers lawful processing. Part III covers controllers and processors, including data protection officers and impact assessments.
- Part II (data subject rights), Part IV (solicited messages) and Part VII (penalties) still wait for a separate order.
- WhatsApp's own policy already requires opt-in that names your business and the WhatsApp channel.
- Every promotional SMS carries a 25-cent government levy, and TRCSL has required a free opt-out since January 2020.
What starts on 1 January 2027
The Personal Data Protection Act No. 9 of 2022 (PDPA) was enacted in March 2022 but has been switched on in stages. The Data Protection Authority was set up first. The rules that apply to everyday businesses were scheduled for March 2025, then postponed.
The PDPA (Amendment) Act No. 22 of 2025, certified on 30 October 2025, changed how the rest of the Act starts. Its new section 1(3) says the remaining provisions "shall come into operation on such date or dates as the Minister may appoint, by Order published in the Gazette".
Gazette Extraordinary No. 2498/16 of 22 July 2026, an Order made on 13 July 2026 by the President as Minister of Digital Economy, appoints 1 January 2027 as the date on which sections 2 and 3 and Parts I and III come into operation. Other Parts, including the marketing message rules in Part IV, need a later Order.
| Date | What happened | Effect for marketers |
|---|---|---|
| March 2022 | PDPA No. 9 of 2022 enacted | Law passed, not yet in force for businesses |
| July 2023 | Part V in operation (Data Protection Authority) | Regulator set up |
| 1 December 2023 | Parts VI, VIII, IX and X in operation | Authority's powers and administration |
| 30 October 2025 | Amendment Act No. 22 of 2025 certified | Remaining Parts start by Ministerial Order |
| 22 July 2026 | Gazette Extraordinary No. 2498/16 published | Sets 1 January 2027 for Parts I and III |
| 1 January 2027 | Parts I and III in operation | Lawful basis, data protection programme, controller duties |
| Not yet set | Parts II, IV and VII | Data subject rights, marketing message rules, penalties |
Dates from the Data Protection Authority's website, the Amendment Act and Gazette 2498/16. The DPA's own page still shows the earlier March 2025 plan.
Part I: processing personal data
Part I sets the core rules. A controller must have a lawful basis for processing and use data only for specified, explicit and legitimate purposes. Section 12 asks every controller to run a documented "Data Protection Management Programme" with internal controls and records that show compliance.
Part III: controllers and processors
Part III covers the organisations that hold data and those that process it for them. It includes data protection officers (section 20) for organisations that monitor people regularly and systematically or process sensitive data at scale. It also requires an impact assessment before systematic and extensive evaluation of people, such as profiling (section 24).
For a messaging team, your SMS gateway, WhatsApp provider and CRM are usually processors acting for you. Your contracts with them should say what they may do with your customer data.
What is not in force yet
Three Parts are still waiting for their own Order, according to the same analyses:
- Part II, data subject rights. Access, correction, erasure and objection will not be operational on 1 January 2027.
- Part IV, solicited messages. This is the Part about using personal data to send marketing messages. Commentary on section 27 describes it as an opt-in rule: no marketing message without the person's clear consent.
- Part VII, penalties. The Act allows penalties of up to LKR 10 million per non-compliance with a directive, but that regime is not yet switched on.
"Not yet in force" is not a reason to wait. Part IV can be switched on by a single Gazette Order, and a list built without consent records cannot be fixed afterwards. Start recording consent now and you will not need to rebuild your list later.
What personal data your messaging list holds
A phone number on its own is personal data when it links to a person. Most marketing lists hold much more than that. Map it before you decide what you need.
| Data item | Where it usually lives | Do you need it? |
|---|---|---|
| Name and mobile number | CRM, POS, e-commerce store | Yes, to address and reach the customer |
| WhatsApp profile name and chat history | WhatsApp inbox or Unecast | Keep for support; set a retention period |
| Purchase history and segments | Store, ERP, CRM | Only for the purposes you told customers about |
| Preferred language (Sinhala, Tamil, English) | CRM field | Useful and low risk |
| Delivery and read receipts | SMS gateway, WhatsApp platform | Keep for reporting; delete on a schedule |
| Consent record | Your consent log | Yes, this is your evidence |
Lawful basis and consent records
Part I requires a lawful basis for each purpose. Order updates and OTPs usually rest on the service the customer asked for. Promotions are different: the clean basis is consent, and that is what Part IV is expected to demand.
Commentary on Schedule III describes good consent as freely given, specific, informed and unambiguous, shown by a clear action. Pre-ticked boxes and consent hidden in terms and conditions do not qualify.
A consent log you can start using today
Keep one row per person, per channel and per purpose. A spreadsheet works for small lists; a CRM field set works better at scale.
| Field | Example | Why it matters |
|---|---|---|
| Mobile number | +94 77 123 4567 | Who agreed |
| Channel | Consent is per channel | |
| Purpose | Offers and new arrivals | Consent is per purpose |
| Source | Checkout page, Colombo store QR, website form | Shows how you collected it |
| Wording shown (version) | "Send me offers on WhatsApp from Example Store" v2 | Proves it was informed |
| Language | Sinhala | Proves the person could read it |
| Date and time | 2026-11-06 14:32 | When consent started |
| Opt-out date | Blank, or the date they stopped | When you must stop |
Example consent log fields. Adapt them with your lawyer.
Store the exact wording each customer saw. If you change a form, give the wording a new version number so old and new consents stay distinguishable.
WhatsApp opt-in rules you already have to follow
If you use the WhatsApp Business Platform, Meta's policy already asks for opt-in. Meta's developer documentation says businesses must:
- "clearly state that a person is opting in to receive messages from the business over WhatsApp";
- "clearly state the business' name that a person is opting in to receive messages from";
- "comply with applicable law".
Meta also asks you to give clear instructions for opting out of specific message categories, and to honour them. People who feel they never opted in can block or report you. Those signals lower your quality rating, and sustained low quality leads to rate limits.
For a full walkthrough of WhatsApp setup and template categories, see how to get the WhatsApp Business API in Sri Lanka and our WhatsApp marketing in Sri Lanka page.
SMS rules: the levy and the TRCSL opt-out directive
Two SMS rules already apply, regardless of the PDPA timetable.
The 25-cent promotional levy
The Finance (Levy on Mobile Short Message Services) Regulations No. 1 of 2019, published in Gazette 2104/16, set a levy "at the rate of 25 cents per each mobile short message" for bulk advertisement SMS from 1 January 2019. Regulation 3 says the advertiser pays it, through the mobile operator. That is one reason promotional SMS costs more than transactional SMS. Bloomwire's promotional rate of LKR 0.70 per SMS is quoted inclusive of government taxes.
The TRCSL opt-out directive
In January 2020 the Telecommunications Regulatory Commission of Sri Lanka told mobile operators to give subscribers a free way to opt out of unsolicited promotional messages. Operators also agreed to change contracts so third-party senders obtain consent first, the Sunday Times reported.
Some sources also describe time-of-day and frequency limits for promotional SMS. These are reported for operators' own promotions, and we have not verified them as rules for businesses. Ask your SMS provider which limits apply to your sender ID.
Alphanumeric sender IDs such as EXAMPLESTORE are one-way: customers cannot reply to them. "Reply STOP" does not work unless you give a number, a short link or a WhatsApp chat where the request is actually received and actioned.
Opt-out wording in English, Sinhala and Tamil
Write the opt-out in the language of the message. Remember that one Sinhala or Tamil character switches an SMS to Unicode, which cuts the limit from 160 to 70 characters. Check the length in our free SMS character counter before you send, and read how Sinhala and Tamil SMS length affects cost.
Have a native speaker check the final wording for your brand voice. Our WhatsApp message templates for Sri Lankan businesses include more examples in all three languages.
A 10-step checklist before 1 January 2027
- Name an owner.Give one person responsibility for customer data in marketing, and decide whether you need a data protection officer under section 20.
- Map every list.List each SMS, WhatsApp and email audience, where it came from and which system holds it.
- Write down the purpose of each list.Order updates, OTPs, support and promotions are different purposes. Do not reuse a delivery list for offers without consent.
- Record a lawful basis per purpose.Note it in your data protection programme (section 12).
- Start a consent log.Use the fields in the table above for every new sign-up from today.
- Fix your sign-up wording.Name your business, the channel and the type of messages. Remove pre-ticked boxes.
- Add a working opt-out to every promotion.A number or link that is monitored, or a WhatsApp quick-reply button, actioned within a day.
- Re-confirm old lists.Send a utility-style message or a clear opt-in request to contacts with no consent record, and stop promoting to those who do not confirm.
- Check your processors.Confirm your SMS gateway, WhatsApp provider and CRM have written terms on how they handle your data.
- Set retention periods.Decide how long you keep chat transcripts, receipts and inactive contacts, and delete on schedule.
Frequently asked questions
Does the PDPA apply to my SMS and WhatsApp marketing from 1 January 2027?
Parts I and III apply from that date under Gazette Extraordinary 2498/16. They cover lawful processing and controller duties, which include your marketing lists. The specific marketing message rules in Part IV are not yet in force.
Do I need consent to send promotional SMS in Sri Lanka?
Part IV, expected to require opt-in for marketing messages, has no start date yet. However, TRCSL has required a free opt-out since 2020, and operators ask third-party senders to obtain consent. Collecting and recording consent now is the safe approach.
Is WhatsApp marketing allowed without opt-in?
No. Meta's policy requires opt-in that names your business and says the person will get messages on WhatsApp. Messaging people who did not opt in leads to blocks, reports, lower quality ratings and rate limits.
What are the penalties under the PDPA?
The Act allows penalties of up to LKR 10 million per non-compliance with a directive. The penalty regime in Part VII is not yet in operation, so it does not start on 1 January 2027 under the current Order.
Do OTP and order update messages need marketing consent?
They serve a different purpose from promotions, usually the service the customer asked for. You still need a lawful basis and must not add promotional content to them without consent.
Is this legal advice?
No. This guide summarises public sources for marketing teams. Read the Act and the Gazette Orders, and ask a lawyer before making compliance decisions.
Sources
- Establishment of the Data Protection Authority (dpa.gov.lk)
- Personal Data Protection (Amendment) Act No. 22 of 2025 (PDF)
- Neelakandan & Neelakandan: Data protection in transition
- Concentric AI: Sri Lanka's PDPA takes effect 1 January 2027
- Developer Office: commentary on PDPA Part IV and section 27
- Meta for Developers: Get opt-in for WhatsApp
- Gazette Extraordinary No. 2498/16: Personal Data Protection Act (Appointment of Date) Order
- Gazette 2104/16: Finance (Levy on Mobile Short Message Services) Regulations No. 1 of 2019
- Sunday Times: TRCSL pushes for opt-out options for mobile users (19 January 2020)
