Recording job interviews in Sri Lanka: the PDPA from January 1, 2027, consent and the 2025 amendments

Ask the candidate before you record a job interview in Sri Lanka, but know that the country's data protection duties start on January 1, 2027. A Gazette Extraordinary of July 22, 2026 appoints that date for sections 2 and 3, Part I (processing of personal data) and Part III (controllers and processors) of the Personal Data Protection Act, No. 9 of 2022 (the PDPA), as amended by Act No. 22 of 2025. As of November 2026 we found no order bringing Part II (the rights of data subjects) or Part VII (penalties) into operation. Interviews you record now will still be on file when the duties apply, so build the notice, the lawful basis and the retention period in today.

This page adds Sri Lanka to our country series alongside India, which is also between enacting its law and enforcing it, and Singapore. It is for recruiters, agency consultants and hiring managers who interview candidates located in Sri Lanka by video or phone, including from the US, the Gulf and Europe, and for agencies that place Sri Lankan candidates with employers abroad. Its focus is the timetable: what applies now, what changes on January 1, 2027, and what is still waiting for a date.

Sri Lanka's rules at a glance

Is it legal to record a job interview in Sri Lanka?

Recording with the candidate's knowledge and agreement is the safe course, and no statute we reviewed allows covert recording of a candidate. The data protection rules that will govern the recording and transcript are not yet in operation, and we could not confirm the wording of the interception offenses from official texts, so this page does not say whether a participant may record without consent. In practice, tell the candidate, ask, and record only after a clear yes. That is also what the PDPA will require from January 1, 2027 if consent is your lawful basis.

When do the PDPA's duties start?

The PDPA was certified on March 19, 2022, and its parts are being brought into operation by order. The sequence, from the orders the DPA publishes:

1. July 17, 2023: Part V, which created the Data Protection Authority (Gazette 2341/59).
2. December 1, 2023: Parts VI, VIII, IX and X, on the Authority's staff, its fund, miscellaneous provisions and interpretation (Gazette 2366/08).
3. March 18, 2025, cancelled: the same 2024 order set this date for Parts I, II, III and VII, but an order of March 14, 2025 (Gazette 2427/34) repealed that paragraph. A Ministry of Digital Economy media release of February 24, 2025, published by the DPA, explains that the Cabinet wanted more time and amendments before enforcement.
4. October 30, 2025: the Personal Data Protection (Amendment) Act, No. 22 of 2025 was certified. It lets the Minister bring provisions into operation "on such date or dates" as the Minister appoints.
5. January 1, 2027: an order of July 13, 2026 (Gazette 2498/16, July 22, 2026) appoints this date for "Section 2, Section 3, Part I (Processing of Personnel Data) and part III (Controllers and Processors)."

The DPA's Circular No. 01/2026 of August 7, 2026 adds that the Authority "would only investigate complaints, hear appeals, etc., once the relevant governing provisions are brought into operation." Until Part II and Part VII have dates, candidates' statutory rights and the penalty regime are not yet live.

What will the PDPA require for a recorded interview?

From January 1, 2027, the PDPA applies to processing that "takes place wholly or partly within Sri Lanka," and to controllers or processors that are domiciled, resident, incorporated or established in Sri Lanka, that offer goods or services to people in Sri Lanka, or that specifically monitor their behavior there (section 2). The DPA's circular notes that it protects the personal data of "both citizens and non-citizens." For a recorded interview, the main duties are:

• A lawful basis (section 5 and Schedule I). Consent; processing "necessary ... in order to take steps at the request of the data subject prior to entering into a contract"; a legal obligation; an emergency; a public task; or legitimate interests, "except where such interests are overridden by the interests of the data subject."
• Conditions for consent (Schedule III). The controller "shall demonstrate that the data subject has consented"; a consent request inside a wider document must be "clearly distinguishable"; whether consent is freely given turns partly on whether something is made conditional on unnecessary processing; and "prior to giving consent, the data subject shall be informed" that consent can be withdrawn at any time.
• Notice at collection (section 11 and Schedule V). Your identity and contact details, the DPO's contact details where there is one, the purposes and legal basis, any legitimate interest relied on, the categories of data, the right to withdraw consent, recipients, and "any cross-border transfer of the personal data that the controller intends to carry out."
• Purpose, accuracy and retention (sections 6 to 10). Specified purposes, no incompatible reuse, accuracy, retention no longer than needed, and security measures.
• A Data Protection Management Programme (section 12) to document how you meet these duties and handle requests.

The power imbalance in hiring makes consent weaker than it looks, so many employers will pair consent to the recording with "steps prior to a contract" or legitimate interests for the notes and scorecard. Whichever you choose, write it down and put it in the notice.

What about health, religion and criminal records?

The PDPA's "special categories" are data revealing "racial or ethnic origin, political opinions, religious or philosophical beliefs," genetic data, biometric data for unique identification, health, sex life or sexual orientation, "personal data relating to offences, criminal proceedings and convictions," and data relating to a child. Schedule II allows processing them with consent for purposes specified at the time, or where necessary for employment obligations "in so far as it is provided for in any written law providing for appropriate safeguards." Do not ask about these subjects, keep anything volunteered out of notes and scorecards, and delete audio that captured it early.

Do you need a data protection officer or an impact assessment?

Section 20, as amended in 2025, requires a DPO for ministries and government departments, and for any controller or processor whose core activities involve regular and systematic monitoring or special categories on a scale to be prescribed, or processing that "results in a risk of harm affecting the rights of the data subjects," as the Authority will set out in guidelines. A recruitment agency recording interviews at volume should check those guidelines when they appear. Section 24 provides for data protection impact assessments for specified processing, and section 23 for breach notifications to the Authority in a form and time to be set by rules. The DPA's guidelines page lists draft regulations on DPOs and impact assessments and draft breach notification rules, published for consultation; they are drafts, not law.

What if you interview a candidate in Sri Lanka from the US?

Section 2 can reach you from January 1, 2027, because part of the processing takes place in Sri Lanka and you may be offering a service to, or assessing, a person there; how the Authority applies that to an overseas recruiter is a question for local counsel. Your own state's law governs your side of the call; see two-party consent states.

The 2025 amendment replaced the cross-border rule. New section 26(1) lets a controller or processor "engage in cross-border data flows, only where" it ensures compliance with Part I, Part II and sections 20 to 25, and section 26(2) requires it to adopt instruments specified by an Authority directive "to ensure binding and enforceable commitments of the recipient in the third country." Section 26(3) also allows a transfer where "the data subject has explicitly consented to the proposed cross-border data flow, after having been informed of the possible risks," or where it is necessary for a contract or pre-contractual steps taken at the data subject's request. The DPA's circular says a draft directive "recognizes several instruments such as contractual clauses, codes of conduct, certifications, transfer impact assessments." For a US-hosted note taker, plan on contract clauses and a line in the notice.

Can candidates get the recording, and how long can you keep it?

Once Part II is in operation, section 13 gives a right of access, and section 17(1), as amended, requires the controller to say in writing, "without undue delay and within one month of the receipt of such request," whether it was granted or refused, with reasons. The period may be extended by two months, to no more than three in total, if the candidate is told before the first month ends; requests are "complied with by the controller free of charge," unless rules made by the Authority allow a fee; and the controller must tell the candidate about the right of appeal to the Authority. Our candidate data access requests guide has a workflow.

On retention, section 9 limits keeping personal data to what is necessary for its purposes. Keep the notes and scorecard that support the decision for a stated period, delete audio sooner, and tell candidates both periods. Our retention policy template gives the structure.

Can you use AI note takers or transcription?

Yes, with notice that names the tool and where it stores data, a lawful basis, a written processor contract, and a cross-border instrument or explicit consent for a vendor abroad. Once Part II applies, section 18 will let a candidate ask for a review of a decision based solely on automated processing that is likely to have an "irreversible and continuous impact" on their rights, which the 2025 amendment extends to rights under "the Constitution or any written law," so keep a human decision on every candidate. Ask the vendor whether it trains models on your interviews. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Sri Lanka

"Before we start: I'd like to [record this interview / use software
that turns our conversation into text] so I can keep an accurate
record of your answers. We'll use it only for this recruitment,
share it only with [the client / the hiring manager], store it with
[vendor] in [country], and delete it [period] after the decision.
You don't have to agree, and you can withdraw your consent at any
time; if you'd rather not be recorded, we'll continue with written
notes and it won't affect your application. Do you agree?"

The line covers what Schedule V and Schedule III will ask for: who receives the recording, where it goes, and the right to withdraw, told before consent is given. The PDPA is published in Sinhala, Tamil and English; offer the line in the candidate's preferred language, prepared by a fluent speaker, and note the answer. More wording is in the interview recording consent script.

Checklist before you record interviews in Sri Lanka

• Candidate told and asked before any recording or live transcription; no covert recording.
• Lawful basis chosen and written down; consent evidence kept, with the right to withdraw explained first.
• Schedule V notice in the invitation, including recipients and any transfer abroad.
• No questions on ethnicity, religion, politics, health, sex life or criminal history.
• Processor contracts and cross-border clauses ready for January 1, 2027; DPO and impact assessment needs checked against the Authority's guidelines.
• Access requests answered within one month; audio deleted on a stated schedule.
• DPA website checked for the Part II and Part VII operation dates and final regulations.

Interviewing elsewhere in South Asia? Compare India, Pakistan and Bangladesh.