Cyber Security Bill to be submitted to cabinet this month

The upcoming Cyber Security Bill is set to be presented before the Cabinet of Ministers by the end of the month. The bill was published for public consultation last year and is now scheduled for submission as per State Minister of Technology Kanaka Herath. The minister also mentioned that the draft is currently undergoing revisions following feedback from the Ministry of Defense.

The Cyber Security Bill was originally part of the Information and Cyber Security Strategy of Sri Lanka (2019: 2023), now the National Cyber Security Strategy of Sri Lanka (2024 – 2027)[draft]. It’s also encompassed in the recently approved National Digital Strategy 2030 which highlights cyber security as a strategic area of action. According to the minister, “collaborative efforts involving 29 government agencies, alongside the Sri Lanka Computer Emergency Readiness Team (SL CERT)” are underway to strengthen the country’s cyber security.

Years in the making

Back in 2018, a previous iteration of the bill was approved by the Cabinet to be presented to the Parliament. However, the bill remained stagnant until renewed efforts were made two years later. In early 2023, Herath stated that the bill would be passed into law during the year, followed by the establishment of the Cyber Security Regulatory Authority.

Interestingly, the Sri Lankan government has been ramping up efforts at setting up regulatory frameworks around cyber security and the overall digital space. In 2022, the Data Protection Act was passed into law with a fully functional Data Protection Authority by late 2024/early 2025. More recently, the government also announced plans to present a bill to amend the Telecommunications Regulatory Act, its first update in 28 years.

However, it’s worth noting that not all recent legislature has been received well. The Online Safety Act No. 9 of 2024 has raised alarming concerns from many communities, including corporations and non-governmental organizations. Incidentally, some of these concerns are already seemingly validated with incidents like the SL Army Commander filing a case under the Online Safety Act and Minister Harin Fernando urging police action under the same act.

As of now, it remains to be seen how the Cyber Security Bill will pan out in terms of implementation. The Cyber Security Bill potentially offers a much-needed regulatory framework around data privacy and digital security for the Sri Lankan citizenry. But the effectiveness of such an act will only go so far as the implementation of an adjacent law like the Online Safety Act for the average citizen. Either way, it’s a step in the right direction. A cautionary one, but a step nonetheless.