The open-source home of PDPA compliance for Sri Lanka. Free, practical, technology-led resources to comply with the Personal Data Protection Act, No. 9 of 2022 (PDPA), build your Data Protection Management Programme (DPMP) under Section 12(2), and implement enterprise-grade Data Loss Prevention (DLP) — including AI-powered data protection.
-purple){kind=icon}
Sri Lanka's Personal Data Protection Act (No. 9 of 2022) is moving toward full enforcement under the Data Protection Authority of Sri Lanka. Its core accountability instrument is the Data Protection Management Programme (DPMP), issued under Section 12(2) of the Act. Demand for practical, technology-led compliance support is rising fast — and most guidance is either legal-only or locked behind consultancies.
OpenDLP-LK closes that gap. We are a community-driven, MIT-licensed project providing everything a Sri Lankan organisation needs to go from "the PDPA applies to us" to "we have a working, auditable DPMP backed by real DLP controls."
What is the PDPA? The PDPA is Sri Lanka's Personal Data Protection Act, No. 9 of 2022 — the country's first comprehensive data protection law. It regulates how controllers and processors collect, use, store and share the personal data of individuals in Sri Lanka, and is enforced by the Data Protection Authority of Sri Lanka.
What is a DPMP? A Data Protection Management Programme (DPMP) is the internal accountability framework controllers must implement under Section 12(2) of the PDPA. It documents your policies, records of processing, risk assessments, training, breach response and monitoring controls that demonstrate ongoing compliance.
What is DLP? Data Loss Prevention (DLP) is the set of tools and processes that discover, classify, monitor and protect sensitive data — Sri Lankan NIC numbers, passport numbers, bank account details, health records — preventing unauthorised disclosure. DLP supplies the technical safeguards a DPMP needs to be more than paperwork.
How do PDPA, DPMP and DLP fit together? PDPA is the law → DPMP is the management programme the law requires → DLP is the technology that enforces and evidences it.
| Resource | Description | Link |
|---|---|---|
| 🗺️ 5-Phase Implementation Roadmap | Planning → Discovery → Policy → Pilot → Monitoring, in 6–12 months | Implementation Guide |
| ⚖️ PDPA Compliance Guide | Requirements mapped section-by-section, gap analysis, reporting | PDPA Compliance |
| 📋 DPMP & Policy Templates | Ready-to-customise policies, checklists and training materials | Templates |
| 🔍 Sri Lankan Data Patterns | Regex/detection patterns for NIC, passport, driving licence, banking formats | Data Patterns |
| 🛠️ DLP Tooling Guide | Open-source and commercial DLP tools evaluated for the LK context | Tools |
| 🏆 Data Champions Program | Train department leaders to drive DLP adoption, with certification | Data Champions |
AI adoption raises the data-protection stakes — and also strengthens the defence:
- DLP for the AI era — prevent sensitive personal data (NIC, financial, health) from leaking into public AI chatbots, prompts and third-party LLM APIs; govern shadow-AI usage under your DPMP.
- AI-powered DLP — machine-learning classification catches sensitive Sri Lankan data that regex alone misses (documents, images, Sinhala/Tamil text), reducing false positives in monitoring.
- PDPA-aligned AI governance — automated processing and profiling of personal data falls squarely under the PDPA; our guidance shows how to bring AI systems inside your DPMP's records of processing and risk assessments.
Banks and finance companies • Telecoms • Healthcare providers • Government and public authorities • BPO/KPO and IT services • E-commerce • Any organisation processing personal data of individuals in Sri Lanka — plus the Data Protection Officers (DPOs), CISOs, compliance teams and engineers who serve them.
➡️ opendlp-lk.github.io — the full guide, or jump straight to Getting Started.
We welcome contributions from security professionals, lawyers, DPOs and engineers across Sri Lanka and beyond — templates, data patterns, translations (Sinhala / Tamil), case studies and tooling guides. See the contribution guide or open an issue in any repository.
MIT — free to use, fork, customise and share. Attribution appreciated.
Topics: pdpa pdpa-sri-lanka dpmp data-protection-management-programme dlp data-loss-prevention personal-data-protection-act section-12-2 data-protection privacy compliance sri-lanka cybersecurity data-security ai-governance ai-data-protection nic-protection dpo
OpenDLP-LK — Open-source Data Loss Prevention and PDPA / DPMP compliance for Sri Lankan enterprises, aligned with the Personal Data Protection Act, No. 9 of 2022.
