Sri Lanka's AI push needs stronger data-governance rules, analysts warn

Sri Lanka's emerging national artificial-intelligence strategy is drawing calls for stronger data-governance foundations before large-scale deployment, with gaps in personal-data protection, copyright rules, and public-data access flagged as potential obstacles to the country's digital ambitions, according to a policy analysis published in the Daily FT.

The Details

A Daily FT column by a research fellow at LIRNEasia argues that Sri Lanka's AI rollout should begin with a more robust data-governance framework. The analysis identifies three specific areas requiring attention: the use of personal data, copyright protections, and the availability of machine-readable public data.

The Information and Communication Technology Agency of Sri Lanka (ICTA) has been developing a national AI strategy over the previous six months, the agency said in May 2025. The strategy focuses on five core areas: data availability, skills development, infrastructure, research and development, and public awareness. ICTA has identified data availability as one of the strategy's foundational pillars, alongside efforts to build technical skills, expand digital infrastructure, advance research and development, and increase public awareness of AI technologies.

Sri Lanka has already established legal mechanisms for data protection. The country enacted the Personal Data Protection Act No. 9 of 2022, creating a statutory basis for regulating how personal data is collected, processed, and stored. In August 2023, the country formally established its Data Protection Authority to oversee personal-data processing activities. The authority says compliance with the law requires not only legislation but also supporting policy frameworks, targeted regulations, and technological safeguards.

President Anura Kumara Dissanayake was scheduled to attend the India–AI Impact Summit 2026 in New Delhi from 16 to 20 February, according to Newswire. The president was quoted in the Daily FT column as saying: "We are updating legal frameworks on personal data protection and cyber security, continuing to invest in digital public infrastructure and strengthening institutions that safeguard public trust while encouraging innovation."

LIRNEasia, a regional policy research organization, maintains a dedicated data-governance research program that links Sri Lanka's AI policy debates with data protection and governance questions.

Context

The Daily FT column frames its argument as an analysis of Sri Lanka's policy push to align AI deployment with data-governance rules. The country's Personal Data Protection Act No. 9 of 2022 and the August 2023 establishment of its Data Protection Authority represent existing legal and institutional infrastructure for data regulation. The column argues that a stronger data-governance foundation is needed to support the broader rollout of artificial-intelligence systems.

ICTA has identified data availability as a core pillar of the national AI strategy. The policy discussion has raised questions about how personal information, copyrighted material, and government records can be made available in machine-readable forms.

The Data Protection Authority says compliance requires not only legislation but also policy frameworks, regulations, and technological safeguards.

What's Next

The national AI strategy remains under development, with ICTA outlining data availability, skills, infrastructure, R&D, and public awareness as its five guiding pillars. The Data Protection Authority says compliance requires supporting policy frameworks, regulations, and technological safeguards in addition to legislation.

President Dissanayake was scheduled to attend the India–AI Impact Summit 2026 in New Delhi.