Budget 2027: GoVTech is underway, the PDPA has been amended, and the DPA is “activated”

The data-protection and government-technology lines in Budget 2027 are a status report more than a new scheme. They matter because they tell founders what the state now says is already in force.

At 3:15 PM Asia/Colombo on 12 November 2026, Newswire’s live updates reported: “Operations have already commenced under GoVTech, which is 100% owned by the Treasury, to implement a roadmap for the digitalisation of public services. The Personal Data Protection Act has been amended, and the Data Protection Authority has been activated.” Newswire’s spelling in that update is “GoVTech.” The official English speech uses “GovTech,” and says the institution “has been established under the 100 percent ownership of the Treasury … and has already commenced its operations.” The official text also says the Personal Data Protection Act “has been amended and the Data Protection Authority has already been established and made operational,” rather than Newswire’s “activated.”

Ada Derana, in a 12 November article on the same passage, went further than Newswire: “state institutions would be required to adopt digital systems through GovTech Sri Lanka.” That mandatory wording was not found in the official English status bullets on GovTech, so it remains a single-source reading. Ada Derana also said the government “expected to introduce new legislation relating to data protection and digital governance at the beginning of 2027.” The official speech confirms a Digital Economy Bill in the first quarter of 2027; see the companion post. The PDPA amendment itself is described in the official text, as in Newswire, in the past tense.

What was already in place

Today’s wording should not be read as the first creation of either body. In August 2026, The Morning reported that the Data Protection Authority had issued Personal Data Protection Circular No. 01/2026 for the public sector, under the Personal Data Protection Act No. 9 of 2022, “as amended by Act No. 22 of 2025.” The same article said the authority was established in 2023, and that it would begin investigating complaints and hearing appeals only after the relevant provisions were brought into operation by the Minister of Technology. The official speech says the Authority “has already been established and made operational.” It does not define what “made operational” covers, or say whether complaint and appeal powers are now in force.

The official speech confirms plans to digitalize the services provided by Divisional Secretariats and Grama Niladharis, among the proposals covered by the Rs. 10,000 million package — confirming a line Daily Mirror had reported at 3:11 PM.

Who it is for

Startups and vendors selling to ministries, departments or state-owned enterprises should assume GovTech is now the implementation path for public-service digitalisation, and should still treat Ada Derana’s “required to adopt” reading as unconfirmed in the official text. Anyone processing personal data — including product companies with Sri Lankan users, payroll tools, health or education apps, and government contractors — should treat the amended PDPA and an “activated” Authority as a compliance reality, not a future bill. This announcement does not, by itself, change tax, funding or export rules.

What founders should do next

If you sell to government, ask your counterpart whether the contract now runs through GoVTech and wait for a written circular before changing delivery plans. If you process personal data, review duties already set out under the PDPA as amended in 2025, including the public-sector circular if you work with state bodies, rather than waiting for a new law. Watch the Q1 2027 digital-economy bills for any further data-governance changes. The official speech is on the Treasury site. Parliament’s timetable has the second-reading vote at 6:00 PM on 20 November and the third-reading vote at 6:00 PM on 14 December (Parliament news, 11 November 2026).

What we still don’t know

We do not know what “made operational” means for the Data Protection Authority’s complaint and appeal powers; whether a mandate for state institutions to use GovTech is intended, given that it was not in the official English bullets; or what the public-services roadmap contains. No new standalone allocation for GovTech was stated. Written after the official English speech PDF was opened on 12 November 2026.

Sources opened on 12 November 2026, and checked against the official Budget Speech 2027 PDF on treasury.gov.lk (https://www.treasury.gov.lk/web/budget-speeches/section/2027; file https://www.treasury.gov.lk/api/file/ea495202-fcb1-4c78-b34e-58389cb20738), English text printed pages 19–20. Not legal or data-protection advice. Live-blog wording is retained where it differs.