PDPA Pilot — Sri Lanka readiness check

Check how a website handles personal data against Sri Lanka's PDPA. Runs entirely on your device; nothing is uploaded.

PDPA Pilot checks how a website handles personal data, measured against Sri Lanka's Personal Data Protection Act, No. 9 of 2022. Press Scan and it reports what the page does with cookies, trackers, consent, the privacy notice and the forms that collect personal data — each finding tied to the section of the Act it relates to. Everything runs on your device: nothing about your browsing is uploaded, and there is no account. For site owners, developers and agencies: • Cookies, client storage and third-party endpoints reached by the page • Whether a consent mechanism exists, whether refusing is as easy as accepting, and whether tracking starts before consent • Whether a privacy notice is linked, reachable, and covers the thirteen items Schedule V requires • Forms that collect personal data, with special categories flagged separately • Offshore endpoints, for the cross-border questions under section 26 • A weighted readiness signal, a work list ordered by weight, and exports as Markdown, CSV, JSON or PDF • A starter Data Protection Management Programme under section 12, pre-filled with the data categories, processors and notice gaps the scan found For individuals: • A plain summary of what a site is doing with your data • Request letters under Part II — access, withdrawal of consent, objection, rectification, erasure, and review of an automated decision — each citing the right section and the 21-working-day response duty in section 17 What it deliberately does not do: block or modify anything, read pages you have not scanned, read cookie values or anything you type, collect analytics, or give legal advice. This is a readiness self-assessment, not a compliance determination. The Parts of the Act imposing business obligations commence on dates appointed by Gazette Order. Have a Sri Lankan data-protection practitioner review anything you rely on.