Sri Lanka's PDPA and AI at Work: What Staff Can and Cannot Paste into ChatGPT

By Ammar Ahamed, Founder, Cocoon · 21 October 2026 · Part 2 of 8 in the Corporate AI in Sri Lanka series

The ten-second paste

Picture a customer service executive in Colombo at 4.45 on a Friday. A long, angry complaint has come in. She copies the whole email, with the customer's name, phone number, account details and a description of a family emergency, pastes it into a free chatbot on her phone, and asks for a polite reply.

The reply is good. The customer is calmed down. Nobody notices anything.

Some version of that happens in almost every Sri Lankan office now. It is not carelessness. People have found a tool that makes a hard part of their job easier, and nobody has told them where the line is. That gap, between how staff already use AI and what the company has said about it, is exactly what Sri Lanka's data protection law is about to make expensive to ignore.

What changes on 1 January 2027?

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (the PDPA), has been coming into force in stages. The Data Protection Authority itself has operated since July 2023. The parts that matter most for companies kept being pushed back: a start date of March 2025 was repealed before it arrived, and the Act was amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025.

In July 2026 the government published a Gazette order, No. 2498/16, which according to the Authority's announcement brings the core duties into operation on 1 January 2027. That covers Part I, the rules on lawful processing of personal data, and Part III, the obligations of controllers and processors. Part III is where the practical work sits: Data Protection Officers in some cases, notifying personal data breaches, data protection impact assessments for risky processing, contracts with processors, and rules on sending personal data out of Sri Lanka.

Two parts still had no start date when we checked: Part II, which gives people rights over their data, and Part VII, which deals with penalties. Dates have moved before, so treat January 2027 as the date to plan for, and check the Authority's announcements as it gets closer.

Is pasting data into a chatbot "processing"?

In practical terms, yes. Data protection laws, the PDPA included, define processing very broadly: collecting, storing, using, sharing or otherwise handling personal data all count. Typing a customer's name and phone number into an AI tool is handling it.

The next question is who is responsible. The Act defines a controller as any person or body which, alone or jointly with others, "determines the purposes and means of the processing of personal data". When your employee uses an AI tool to do your company's work, on your company's customer, it is very hard to argue that the company is not the controller. The fact that the employee chose the tool without asking does not move the responsibility to them.

That is why "we never approved ChatGPT" is not a defence. If staff are using AI on company data, the company needs to have decided how.

Is it a cross-border transfer?

The PDPA defines a cross-border data flow as the movement of personal data out of Sri Lanka for processing in a third country. Most of the AI assistants Sri Lankan staff use are run by companies whose servers are overseas.

Our reading is that pasting personal data into one of those tools is likely to be treated as moving it out of the country. To be clear, that is our interpretation: the Authority had not issued AI-specific guidance when we wrote this.

The 2025 amendment rewrote the cross-border rules. Transfers are allowed where the controller meets its other duties under the Act and uses safeguards the Authority specifies, and there are listed exceptions, such as the person's explicit, informed consent. A free personal chatbot account, used without the company's knowledge, is unlikely to sit comfortably inside any of that. An approved business tool, with a contract and settings your IT and legal teams have checked, is a far stronger position.

What are the penalties?

The Act lets the Authority issue directives to a controller that is not complying, and its penalty provisions allow a fine of up to LKR 10 million for each failure to comply with a directive, with the penalty doubling for repeat failures. As noted above, the penalty part of the Act still had no start date when we checked.

For most companies, the fine is not the biggest risk anyway. The bigger costs are a customer whose private details turn up somewhere they should not, a staff member's salary or health information leaking, or a client finding out their confidential file went into a public tool. In a market as small and connected as Sri Lanka's, that story travels fast.

The traffic-light rule for staff

The simplest guideline we have seen work is a traffic light. It fits on one page, people remember it, and it covers most real cases.

The trick that makes this workable is teaching people to strip details before they paste. "Draft a reply to [Customer A], who was charged twice for [Product] and is upset about [the delay]" gets almost exactly the same quality of answer as the original email. It just carries none of the risk.

Seven things to do before January

1. Find out what is already happening. Run a short, anonymous survey: which AI tools people use, on which accounts, and for what. Anonymous matters. Nobody will admit to the Friday-afternoon paste if they think it goes on their record.

2. Approve tools, and give people accounts. If the only AI people can reach is a free personal account, that is what they will use. Pick the tools you are comfortable with, check the business terms with IT and legal (including whether your inputs are used to train the vendor's models), and roll out work accounts.

3. Issue a one-page guideline. The traffic light above, the approved tools, who to ask, and where to report a mistake. Our free AI Policy builder drafts a fuller policy if you need one, and we cover the wider picture in the AI policy every company needs.

4. Map the higher-risk uses. AI that screens job candidates, scores customers, or handles health or financial details deserves a proper data protection impact assessment before it goes live, not after.

5. Name a privacy contact. Whether or not your company is required to appoint a Data Protection Officer, someone needs to own these questions. Make it a named person, and tell staff who it is.

6. Put a breach path in place that includes AI. If something sensitive went into the wrong tool, staff should know to report it the same day, and that reporting early is treated as the right thing to do. Hidden mistakes are the expensive ones.

7. Train people, with practice. Which brings us to the part most companies skip.

Why a policy alone will not work

Most AI policies are careful, sensible, and unread. A PDF in the HR system does not change what happens at 4.45 on a Friday.

What changes behaviour is practice. Good training has people work on realistic but entirely fictional data: a complaint from a made-up customer, a CV from a made-up candidate, a made-up supplier contract. They learn to strip and replace details, to check what a tool does with their input, and to tell green work from red work by instinct. The exercises never need a single piece of real personal data. If a provider asks you for real customer records to make a session "realistic", that is your answer about them.

Done well, the PDPA is not a reason to slow AI down. It is the push most companies needed to stop pretending staff were not already using it, and to give them a safe, approved way to do it properly. That is a better outcome for customers, for staff and for the business.

One thing to try this week: ask five people in different departments, privately, what they last pasted into an AI tool. Their answers will tell you how urgent January really is.

This article explains the law in general terms for a business audience. It is not legal advice. Take advice from a qualified lawyer on your company's specific obligations.

Frequently asked questions

Sources

1. Personal Data Protection Act, No. 9 of 2022 (Parliament of Sri Lanka)
2. Personal Data Protection (Amendment) Act, No. 22 of 2025 (Parliament of Sri Lanka)
3. Daily FT, "Data protection compliance regime takes effect on 1 Jan 2027"
4. readme.lk, Personal Data Protection Act No. 9 of 2022: implementation timeline
5. Data Protection Authority of Sri Lanka