A Comprehensive Privacy Law Exists — But Isn't Actually in Force Yet

Sri Lanka's Personal Data Protection Act was passed back in 2022, closely modeled on the EU's GDPR, and grants citizens meaningful rights including access to their data and details on how it's processed. But here's the catch: the substantive provisions of the law — covering data processing rules, data subject rights, and penalties — were originally scheduled to take effect on March 18, 2025, and that implementation date was subsequently repealed, leaving these core protections without any confirmed date to actually come into force. Sri Lankans have a modern privacy law on paper that, in practice, still isn't protecting them.

Nearly 2 Terabytes of Customer Data Was Exposed at a Major Bank

While the law waits to be activated, real breaches keep happening. In 2025, Cargills Bank suffered an incident that led to the public release of over 1.9 terabytes of customer data — one of the largest single data exposures in Sri Lanka's history, and a stark illustration of what's at stake while comprehensive data protection enforcement remains stalled.

Government Systems Have Already Lost Data Permanently

Public sector vulnerability isn't new in Sri Lanka. A 2023 ransomware attack disrupted government offices on the gov.lk domain and resulted in the permanent loss of data from all 5,000 affected accounts — meaning the information wasn't just exposed, it was gone entirely, with no possibility of recovery for those affected.

A Controversial New Law Targets Online Speech, Not Just Data Protection

Alongside the stalled privacy law, Sri Lanka passed a very different kind of internet legislation in January 2024. The Online Safety Act was passed by Parliament in a 108–62 vote and has been criticized by human rights groups, journalists, and opposition politicians as a means of stifling freedom of speech. Public Security Minister Tiran Alles cited 8,000 instances of cybercrime logged in Sri Lanka in 2023 as part of the justification — but critics argue the law's scope extends well beyond addressing genuine cybercrime into regulating what citizens can say online.

What Sri Lankan Users Should Do Right Now

With the country's core data protection provisions still not formally in force and recent breaches already exposing bank customer data at massive scale, personal-level protection matters more than the current legal framework can offer. A VPN encrypts your internet traffic and masks your real IP address, reducing what trackers, unsecured networks, and data harvesters can collect about your activity regardless of whether comprehensive legal enforcement has actually begun. Choose a VPN with a verified no-logs policy and strong encryption, enable two-factor authentication on your banking and government service accounts, and if you've used services from institutions that have suffered breaches, treat that as a prompt to change your passwords now rather than waiting for a formal notification that current law doesn't yet require.

VPNs Are Legal — Even Though the Government Has Censored the Internet

VPNs are legal in Sri Lanka, although the government has implemented internet censorship. The Sri Lankan government has censored citizens' internet use in the past and has blocked access to certain websites — but the use of VPNs itself remains completely legal. The standard rule applies here too: a VPN restores access to blocked content, but doesn't make illegal activity legal.

What to Look For in a UCN VPN for Sri Lanka

Reliability during moments of crisis matters most in Sri Lanka. The Online Safety Act, No. 9 of 2024 established an Online Safety Commission aimed at regulating citizens' internet usage, and has been criticised by human rights groups, journalists, and opposition politicians as a means of stifling freedom of speech. A UCN VPN with WireGuard® encryption and an independently audited no-logs policy gives you a reliable, private way to browse regardless of how this new framework is applied in practice.

Why Sri Lankans Actually Use a VPN

The most striking episode came in 2022. VPN demand leapt by 17,000% after Sri Lankan president Gotabaya Rajapaksa blocked platforms including Twitter, Instagram, WhatsApp, YouTube, TikTok, Telegram, and Facebook during nationwide protests over the country's economic crisis. The ban proved so ineffective that the government reversed it after VPNs rendered it "completely useless," with even the president's own nephew mocking the decision publicly after accessing Twitter through a VPN. The government has separately maintained a history of blocking specific websites outside of crisis moments too.

What "No-Logs" Actually Means

A no-logs policy means the VPN provider stores no record of your browsing activity, IP address, or connection times — so there's nothing to hand over if it's ever requested. Given the introduction of Sri Lanka's Online Safety Act and its expanded powers over online speech, choosing a provider with an independently audited no-logs policy — and no operational presence inside Sri Lanka — offers meaningfully stronger protection than relying on a marketing claim alone.

Getting Started in Under a Minute

Download the UCN VPN app, sign in, and tap Connect — your traffic is encrypted immediately. Sri Lanka's history shows that restrictions can arrive suddenly during periods of unrest, so setting up and testing a UCN VPN now, before you need it, is the smartest move you can make.

Sri Lanka's 2022 social media ban is one of the clearest examples anywhere of how quickly a VPN can render government blocking pointless. A UCN VPN keeps you ready for whatever comes next.