A perfect storm: Digitalisation, new laws, draft bills, and threats to civic space in Sri Lanka
by Sanjana Hattotuwa in his blog, Colombo, August 18, 2026
Since 2023, Sri Lanka has enacted, circulated or in some way referred to at least 7 laws and draft laws that bear directly on what citizens and organisations can say, publish, fund and organise. These include the Online Safety Act (OSA), the Anti-Corruption Act, the Proceeds of Crime Act, the proposed Protection of the State from Terrorism Act, the draft NGO Registration and Supervision Bill, the 2023 Cybersecurity Bill and a data protection law that remains only partly in force. Alongside them, government is building a digital state at speed, scope and scale, with a unique digital identity, a national data exchange, an upgraded government cloud, digital payments and a single app for public services, with a national AI strategy and a draft sovereign cloud strategy that give human rights little or no attention.
Sanjana Hattotuwa
Many in Sri Lanka have written about one or another of these instruments, and about digitalisation and how government is rolling it out. To my knowledge, no one has studied all of them together, or examined how the powers in one law can be reached through another. My own work over recent years, across research, parliamentary engagement, formal policy feedback and public advocacy – including with grassroots communities working in Tamil, and Sinhala across Sri Lanka – has critically looked at each instrument in turn. This brief draws that work together because the gravest danger lies in what can be called interaction design, and not in any single clause – which is to say, the operation of these instruments in tandem or the availability of legal instruments that prima facie are necessary for the country’s progress, but are Janus faced laws allowing for unprecedented censorship, surveillance, and repression.
Read together, and connected through the digital systems now under construction, these laws (those in our statute books already, and those proposed) would give any government in Colombo, and any Executive President, a credible capacity to intimidate, incapacitate or criminalise dissent without ever declaring an emergency.
What follows describes what is already law and what remains a draft, how the pieces could combine (especially under any future Executive President or government less inclined towards liberal democracy), what each instrument individually, and all of them together would mean for civil society, who would bear the heaviest cost, and some suggestions for democratic safeguards to extent possible.
Key observations
- At least 7 laws and draft laws since 2023, arriving on top of powers the state has held for decades, and alongside a digital state built at speed, scope and scale, with no assessment anywhere by any actor of their combined effect.
- Digitalisation supplies the legibility on which every other instrument depends, through a unique digital identity, a national data exchange, an upgraded government cloud, digital payments and a single app for public services, while the Personal Data Protection Act remains only partly in force until January 2027 and the national AI and draft sovereign cloud strategies give rights little or no attention.
- Voter registration lists were used to identify Tamil households in 1983, and digitisation removes the friction that once limited what state records could do, since what then took days of manual cross-referencing across paper registers now resolves in seconds against a single connected identity.
- The Online Safety Act remains unrepealed and unamended, has never once protected a woman or child, is as available to private parties as it is to the state, and vests its powers in a five-member Commission the President appoints.
- The Anti-Corruption and Proceeds of Crime Acts open money, communications and devices on ex parte process, mapping donors, sources and partners along the way, and reaching organisations never themselves suspected of any offence.
- The draft PSTA would criminalise witnessing, permit proscription by executive act that closes meetings, funds, grants, lobbying and publications at a stroke, and order decryption that providers holding no keys cannot perform.
- The draft NGO Bill supplies the register rather than the coercion, with a Competent Authority answering to a Minister who answers in turn to the President, and its FATF justification collapses against Recommendation 8, which requires targeted and risk-based measures rather than blanket registration.
- A Defence-led cybersecurity law modelled on the 2023 draft, hurried through after the Treasury’s losses, would answer none of the failures that caused them, while wiring the defence establishment into a civilian regulator whose members the President appoints
- The Executive Presidency is where every instrument surveyed here terminates, holding appointments to the Online Safety Commission and the proposed cybersecurity regulator, the power to proscribe, and Defence, the Defence Cyber Command and the Secretary whose signature carries proscription gazettes in one pair of hands.
- The government elected to abolish that office has decided to keep it, describing abolition as a promise that cannot now be prioritised, which leaves the safeguards these laws lack unable to be supplied by the constitutional reform meant to remove the office in which all of them end.
- The count of 7 understates what is already on the statute books, since Section 3 of the ICCPR Act, the Computer Crime Act’s access offences and seizure powers, the regulations giving effect to Resolution 1373, the Public Security Ordinance, the Official Secrets Act and the Bureau of Rehabilitation Act together mean nothing described here requires an emergency to be declared.
- Surveillance is already pervasive and unevenly borne, running through finance, registration and suspicion as much as through interception, and falling heaviest on those least able to contest it.
- The architecture hardens between 2026 and 2028 while the electorate waits until 2029, since data protection commencement, the FATF evaluation, the 22nd Amendment, the digital identity procurement and the GSP+ transition all fall before a vote, and no election can sever a database from those it is linked to or return a biometric to the person it was taken from.
- Those financing this architecture, the World Bank and UN agencies among them, should treat rights as conditions of disbursement rather than as accompanying language, since sequencing, safeguards and scrutiny are cheaper to require now than to retrofit later.
- None of this requires a secret plan, only capacity, weak safeguards, a long record of unequal enforcement and thin remedies.
Access the full brief here.