Clarzio Protect · PDPA
PDPA-ready, the practical way.
We find the gaps, write the policies, train your team and build the systems that keep you compliant, so your own DPO has everything they need.
Obligations start 1 January 2027
What starts on 1 January 2027
Four things every organisation needs in place.
Sri Lanka’s Personal Data Protection Act No. 9 of 2022 applies to any organisation that holds personal data about customers or staff. Some enforcement is phased in later, but the obligations bind from January, so now is the cheapest time to prepare.
Lawful processing
You need a valid reason for every kind of personal data you collect, and you must tell people what you do with it.
A designated DPO
Someone in your organisation must own data protection and be the contact point for customers and the regulator.
Breach notification
When personal data is lost, leaked or stolen, you need a way to detect it, assess it and report it.
Impact assessments
Higher-risk processing, like new systems or sensitive data, needs a documented assessment before it starts.
Sources: Daily FT: Data protection compliance regime takes effect on 1 Jan 2027 · Daily Mirror: Legal experts flag staggered PDPA rollout
How we work
Assess. Fix. Equip. Automate.
- 1
Assess
We interview your teams, map your personal data and systems, and risk-rate the gaps.
- 2
Fix
We write the policies, notices and contract clauses that close those gaps.
- 3
Equip
We train your staff and set up your own DPO with everything they need to run it.
- 4
Automate
We build the workflows that keep compliance running: requests, consent and breach reporting.
Where to start
Three ways in.
Our PDPA services are for organisations in Sri Lanka, so prices are shown in LKR. Outside Sri Lanka? Ask about privacy-by-design builds →
PDPA Readiness Assessment
Know exactly where you stand
From
LKR 150,000
- Interviews with your key teams
- Inventory of personal data, systems and third parties
- Risk-rated gap report against the PDPA
- A 90-day roadmap
- 30-minute leadership readout
1–4 weeks · fee credited if you go ahead with Ready by January
Book an assessmentReady by January
Most chosenAssessment, policies and training in one
From
LKR 400,000
- Everything in the Readiness Assessment
- Leadership briefing and decision paper
- Full policy pack, tailored to your operations
- Staff awareness training session
- Evidence file showing what you have done
4–8 weeks · about 15% less than buying separately
Get ready by JanuaryDPO Enablement
Your own DPO, set up to succeed
From
LKR 150,000
- Role training for the person you appoint
- Registers, templates and procedures they will run
- Request and breach handling playbooks
- Optional ongoing support, from LKR 50,000 / month
Your DPO stays yours · we support them in the background
Set up your DPOWhat makes us different
Others hand you documents. We hand you working systems.
Law firms advise and audit firms assess. We put it into practice: the policies, the training and the everyday workflows that keep you compliant, in the tools your team already uses.
Led by certified Data Protection Officers with more than ten years of enterprise IT leadership across multiple countries.
Built for your team
- Live
Data subject request intake
Requests logged, routed and tracked to deadline
- Live
Consent log
Who agreed to what, and when
- Live
Breach report form
Routed straight to your DPO, with a checklist
- Live
Data inventory
What you hold, where, and why
Add-ons
Everything else you might need.
Board briefing
A 60–90 minute session for directors on obligations, exposure and decisions.
Quoted on request
Policy pack
Privacy notice, policies, breach procedure, retention schedule and supplier clauses.
Quoted on request
Staff awareness training
Data protection and cyber basics, with a quiz and attendance record as evidence.
Quoted on request
Website & lead-capture compliance
Consent forms, cookie banner and privacy notice, fixed on one website.
Quoted on request
Privacy automation
Request intake, consent logs and breach forms built into your own tools.
Quoted on request
Breach simulation
A two-hour practice breach with your leadership team, and a short report.
Quoted on request
Supplier & processor review
Check your cloud, payroll and marketing suppliers, and add the right clauses.
Quoted on request
CCTV & monitoring compliance
Signage, notices, retention and access rules for cameras and device monitoring.
Quoted on request
Who it’s for
Organisations with 20–500 staff that hold customer or employee data but have no in-house privacy team.
- Hospitality
- Retail
- Clinics & healthcare
- Education
- BPOs
- SaaS & startups
Clear boundaries
- Your DPO stays yours. We set them up and support them.
- We deliver compliance implementation, not legal advice. Legal opinions go to our partner law firm.
- Compliance depends on putting the recommendations into practice, so we stay with you while you do.
- Your data is covered by a confidentiality agreement and a data processing agreement.
Questions
What organisations ask first.
No. You appoint your own DPO, usually someone in HR, IT or operations. We train them, give them the tools and support them in the background.
No. We deliver compliance implementation: assessments, policies, training and systems. Where you need a legal opinion, we refer you to our partner law firm.
If you hold personal data about customers or staff, the PDPA applies. The scope of work, and the price, scales with your size and the kind of data you hold.
The obligations bind from 1 January 2027, even though some enforcement is phased in later. The transition period is the cheapest and calmest time to get it right.
Our compliance services are built around Sri Lanka’s PDPA. Elsewhere, we build privacy-by-design websites and systems: consent, request handling and breach reporting.
Be ready by 1 January 2027.
Start with a readiness assessment. In a few weeks you will know exactly where you stand, what to fix first and what it will cost.