Sri Lanka: passenger data record

The Personal Data Protection Act

The Act was certified on 19 March 2022 ¹. Section 28 establishes the Data Protection Authority of Sri Lanka ¹. Special categories of personal data include biometric data used to uniquely identify a person (section 56) ¹. Section 38 caps a penalty at Rs. 10 million for each non-compliance, with twice the earlier amount for repeat failures ¹.

In its original form, section 26 required public authorities to process personal data in Sri Lanka except where an adequacy decision allowed processing in a named third country ¹.

The 2025 amendment

The Personal Data Protection (Amendment) Act, No. 22 of 2025 was certified on 30 October 2025 and published in the Gazette on 31 October 2025 ². It replaces section 1(3), so provisions other than section 1 come into operation on dates the Minister appoints by Gazette order ². The Authority's page we checked still gives 18 March 2025 as the start date for Parts I, II, III and VII ³.

• Section 26 is replaced. Transfers abroad are allowed where the controller or processor ensures compliance with the Act, with safeguards set by Authority directive ². A public authority may not carry out cross-border data flows for categories to be prescribed ².
• "Public authority" now covers ministries, departments, provincial councils and local authorities, and excludes public corporations and companies ².
• The prior consultation requirement in section 25(2) to (6) is repealed ².

Immigration and the ETA

The Department of Immigration and Emigration's 2025 performance report says ETAs were granted to 2,305,352 persons and that ETA made up 39.23 per cent of the department's revenue ⁶. Its IT plans list API/PNR integration and the purchase of a biometric vetting system as future goals ⁶.

From 25 May 2026 nationals of 40 listed countries can get a 30-day tourist ETA free of charge, according to the ETA portal ⁵. SLT-Mobitel had been the ETA solutions provider since 2012, as reported by Charumini de Silva in the Daily FT ⁷.

The 2024 e-visa outsourcing case

The Cabinet approved a new visa system on 11 September 2023, as reported by the Daily FT ⁷. A consortium of GBS Technology Services, IVS Global-FZCO and VF Worldwide Holdings was awarded the contract in December 2023 for e-visa, consular, visa, biometric and tourism promotion services, as reported by Nirupama Subramanian in Newslaundry ⁸. The same report said the visa fee rose from US$50 to nearly US$100, with a US$25 service and convenience fee ⁸.

Parliamentarians and the Sri Lankan chapter of Transparency International filed fundamental rights petitions, as reported by Newslaundry ⁸. Petitioners argued the process violated the law, lacked transparency and skipped competitive bidding ⁷. Petitions argued that handing immigration data to foreign providers violated domestic law and posed national security risks ⁸.

On 2 August 2024 the Supreme Court issued an interim order ⁸. As reported by the Daily FT, the court ordered a return to the previous ETA arrangement and suspended the service and convenience fees under the e-visa system ⁷. Controller General Harsha Ilukpitiya told the Daily FT, in a report published on 21 August 2024: "This is now a legal matter and we have sought the AG's advice to resolve the visa issuing process" ⁷.

On 25 September 2024, after a directive from President Anura Kumara Dissanayake, the ETA system was restored and the department head was arrested for contempt of court, as reported by Newslaundry ⁸. The same report said the department did not implement the 2 August order, and that a Commission of Public Finance enquiry flagged concerns about the contract and ordered a forensic audit of it ⁸. Company statement, as reported by Newslaundry: VFS defended its services in Sri Lanka and said its global reach would raise the country's tourism profile ⁸.

E-gates at Bandaranaike airport

The 2025 performance report lists the launch of automated border control gates at Bandaranaike International Airport as a special achievement, with departure terminal e-gates planned for 2026 ⁶. The new gates failed to scan passports efficiently and delayed arriving passengers, as reported by Chaturanga Pradeep Samarawickrama in the Daily Mirror on 3 February 2026 ⁹. The same report said the system was funded with US$8.4 million from the Japanese government ⁹.

Chronology