Category: Daily Financial Times

CLOVE Beach Wadduwa celebrated its glamorous relaunch with an evening of fashion, flavour, music and mixology, welcoming travel industry professionals, journalists and media personalities to showcase the resort’s renewed identity.

Formerly Serene Pavilions, the property was acquired by MAC Hotels and Villas Ltd., part of the MAC group, and has been transformed into CLOVE Beach Wadduwa, opening in January 2026 with a fresh identity blending contemporary luxury, personalised hospitality and authentic Sri Lankan coastal living.

Set on five acres of beachfront, just 45 minutes from Colombo, the resort comprises 12 Balinese-inspired villas – Ocean Villas overlooking the beach and secluded Garden Villas – each with private decks, plunge pools and jacuzzis.

The relaunch evening featured a mini fashion show and a live mixology showcase, alongside the official key handover by MAC Holdings Managing Director Andre Fernando marking the resort’s new chapter.

Beyond its villas, CLOVE Beach Wadduwa offers personalised dining with chefs tailoring meals to guest preferences, an ocean-facing bar, a spa and a fully equipped gym.

With its renewed identity and commitment to personalised service, CLOVE Beach Wadduwa welcomes guests with the traditional Sri Lankan greeting, ‘Ayubowan,’ and the promise of an unforgettable stay.

Kusal Mendis and Pathum Nissanka have been named in Sri Lanka’s T20I and ODI squads for the tour of England commencing 5 September. Both players missed the recently concluded 2-Test series against India due to injury.

As per the selection committee’s policy that players returning from injury should prove their fitness by playing in a match, Nissanka who underwent surgery in his wrist played in two Major T20 matches for NCC making scores of 31 and 7, but in Mendis’ case he has been picked to lead the team in the two white ball series without playing a single game. Mendis suffered a Grade 3C hamstring injury during the Lanka Premier League and has been recuperating at the High Performance Centre at Khettarama since. He has been going through all the sessions, batting, wicket-keeping and running, but not pushed to 100 percent. On the advice of the physio he was asked not to play although he was keen to.

Mendis is expected to continue his rehab with the team’s physio in England where he is due to prove his match fitness by playing in the two warm-up T20 games against England Lions scheduled for 11 September at Chelmsford and 13 September at Beckenham. Sri Lanka plays their first T20I against England at Southampton on 15 September.

The selectors are taking a gamble by naming Mendis in the squads to England where if he fails to come through Charith Asalanka who has been named Vice-Captain for both formats will return to his former position as white ball captain which he lost during Sri Lanka’s tour to Pakistan last year. Asalanka not only lost the captaincy but also his place in the T20I side after the T20 World Cup in February this year. He however remains a crucial player in Sri Lanka’s ODI set up.

Asalanka has found favour with the selectors in the T20I side on the back of a stellar Lanka Premier League (LPL) season where he helped Galle Gladiators win the title for the first time scoring 385 runs from 11 innings at a strike rate of 153.38 and winning the Player of the Match in the final with 3/20 against Jaffna Kings.

Asalanka replaces Kamindu Mendis as vice-captain of the white ball teams. Since being elevated the pressure of vice-captaincy has had an impact on Kamindu’s performance. It seems that it was too premature to put him there although he is definitely captaincy material for the future.

Two other players from the champion Galle Gladiators side spinners Tharindu Rathnayake (T20I) and Sachindu Colombage (ODI), both uncapped also gain selection. That performance in the LPL does matter is proved by the selection of Lahiru Udara in the T20I squad. Udara, a prolific run-getter in white ball domestic cricket was the leading run scorer in the LPL with 434 runs from nine innings at a strike rate of 159.55 for Kandy Royals which included the highest individual score in the LPL – 132 against eventual champions Galle Gallants. Udara has made only one T20I appearance for his country against Afghanistan in the 2023 Asian Games and his recall to the national side after a three-year gap only confirms the strides he has made in the shortest format.

From the white ball sides that toured West Indies early this year Lasith Croospulle, Milan Rathnayake and Pramod Madushan have been left out paving the way for the inclusion of Udara, Tharindu Rathnayake and Colombage.

With the 50-over Cricket World Cup barely 12 months away, Sri Lanka’s struggles to find a good pinch hitter in their ODI line-up has forced the selectors to recall hard-hitting all-rounder Dasun Shanaka after an absence of two and a half years. Several have been tried out in the number 7-8 slot but none has succeeded.

His inclusion comes on the back of some outstanding performances in T20I cricket this year where he has scored 332 runs in 15 matches at a strike rate of 171.13. He gets another chance to re-establish himself in the ODI set-up. Shanaka, 34 played the last of his 71 ODIs against Zimbabwe in January 2024 before he was dumped from the side following an embarrassing 2023 World Cup where he lost the ODI captaincy to Kusal Mendis.

Sri Lanka plays England in three T20Is at Southampton (15 September), Cardiff (17 September) and Manchester (19 September) followed by three ODIs at Durham (22 September), Leeds (24 September) and Oval (27 September).

ODI squad: Pathum Nissanka, Kamil Mishara, Kamindu Mendis, Charith Asalanka (Vice-Captain), Kusal Mendis (Captain), Janith Liyanage, Pavan Rathnayake, Dasun Shanaka, Wanindu Hasaranga, Dunith Wellalage, Maheesh Theekshana, Sachindu Colombage, Dushmantha Chameera, Eshan Malinga, Asitha Fernando, Dilshan Madushanka

T20I squad: Pathum Nissanka, Kamil Mishara, Lahiru Udara, Kusal Mendis (Captain), Kamindu Mendis, Charith Asalanka (Vice-Captain), Janith Liyanage, Dasun Shanaka, Dunith Wellalage, Wanindu Hasaranga, Maheesh Theekshana, Tharindu Rathnayake, Dushmantha Chameera, Eshan Malinga, Nuwan Thushara, Binura Fernando

Finance and Planning Deputy Minister Dr. Anil Jayantha Fernando yesterday rejected claims that Government debt had increased by over Rs. 190 billion, insisting official data instead showed a continued decline in the debt stock.

In a video statement released by the Finance Ministry, he criticised recent media reports which, citing Central Bank of Sri Lanka (CBSL) data, claimed a significant increase in Government debt, arguing that the reports neither clearly explained the basis of the calculation nor accurately reflected the official figures.

Dr. Fernando said the Government’s debt position should be assessed using the quarterly ‘Debt Bulletin,’ which provides a comprehensive breakdown of domestic and foreign borrowings, including debt contracted from individual countries, multilateral and bilateral lenders, and commercial sources.

According to him, the debt stock has declined when measured in dollar terms. ‘Total debt stood at $ 100.3 billion as at 31 December 2025, falling to $ 98.9 billion by March 2026 and further to $ 95.03 billion by end-June. This clearly shows that the debt has not increased significantly, but rather declined,’ he stressed.

The Deputy Minister also highlighted Government debt towards how borrowed funds are deployed.

He argued that borrowing in itself should not be a concern provided debt sustainability is maintained and funds are channelled towards productive economic and development activities.

‘What we should worry about is if those debts are being obtained for inefficient activities,’ he said.

Dr. Fernando pointed to the improvement in Sri Lanka’s debt-to-GDP ratio as evidence of the Government’s fiscal management following the country’s economic crisis.

‘The ratio had fallen to 95% at end-2025, compared with a target that had originally been expected to be reached only by 2032. By end-June 2026, the ratio had declined further to 88.8% of the GDP,’ he said.

The Deputy Minister described the reduction as evidence of improved management of public finances and said there was no uncertainty regarding the Government’s ability to service its borrowings.

‘There is no uncertainty in repaying these loans too,’ he reiterated.

A skipper’s innings of 70 runs off 89 balls by T.M. Sampath and a four fer by Hesham Madushanaka and two wickets by Upul Hettiarachchi helped new comers to the MCA cricket arena Golden Green Plantation defeat David Pieris Group of Companies by four wickets in the final of the MCA-Abans Premier League 2026 and become the first winners of the ‘Abans Challenge Trophy.’

Electing to bat first David Pieris Group of Companies were restricted to 147 runs in 39.3 overs. Santhush Gunathilake who opened innings topped the score card with a fluent 53 off 50 balls with seven fours and a six. Asitha Wanninayake chipped in with 31 off 59 balls. Heshan Madushanka captured four wickets for 11 runs.

Chasing 148 to win, skipper T.M. Sampath scored 70 runs off 89 balls with seven boundaries and two sixes before being stumped off the bowling of Dilanka Auwardt, with score on 122/5. Shammu Ashan and Mohamed Shamaz shared a 25 run partnership to equal the scores at 147/6 and Shammu Ashan scored the winning runs with a four.

The Golden Green Plantation Team led by T M Samapth comprised, Heshn Madushanka, Malith Mihiranga, Mohamed Shamaz, Randika Mihiranga, Upul Httiarachchi, Dhanuja Induwara, Gimadu Malkam, Sammu Ashan , Vikum Sanjaya and Johan Pathirana

With only four teams entering the prestigious MCA Premier Leaguethis year, DFCC Bank secured third spot having a slightly better run rate over Nawaloka Hospitals and were unlucky that the opportunity for securing a spot in the final was washed away as qualifier 2 was abandoned on two consecutive days due to rain.

Special Awards: Best Fielder of the Final: Dhanuja Induwara of Golden Green Plantation (3 catches and 1 run out); Best Bowler of the Final: Heshan Madushanka of Golden Green Plantation (4 wickets for 11 runs); Best Batsman of the Final: Santhush Gunathilake of David Pieris Group of Companies (53 runs off 50 balls); Player of the Final: T.M. Sampath of Golden Green Plantation (70 runs and 1 wicket); Best Bowler of the Tournament: Tharinda Nirmal of David Pieris Group of Companies (13 wickets in 4 innings); Best Batsman of the Tournament: Pavan Pathiraja of DFCC Bank (267 runs in 4 innings); and Player of the Tournament: Lahiru Samarakone of David Pieris Group of Companies (239 runs and 4 wickets)

Sri Lanka has strengthened national tax collection after the economic crisis. But Municipal Councils, Urban Councils and Pradeshiya Sabhas remain financially weak. Budget 2027 provides an opportunity to begin a long-delayed reform of local-government finance.

Sri Lanka is approaching the preparation of Budget 2027 at an important stage of its economic recovery. Much attention will understandably be given to government revenue, expenditure control, debt sustainability, investment and economic growth.

But there is another area of public finance that receives surprisingly little attention: the financial capacity of local government.

Municipal Councils, Urban Councils and Pradeshiya Sabhas are the level of government closest to citizens. They deal with many services people encounter in everyday life-roads and drains, waste disposal, markets, public health, street lighting, permits, community facilities and local infrastructure.

Yet the financial system supporting these institutions has changed remarkably little.

Recent evidence covering 2019-2024 reveals a serious mismatch between the responsibilities assigned to local authorities and the financial resources they can raise themselves. In other words, Sri Lanka has decentralised many administrative responsibilities without adequately decentralising the financial capacity needed to perform them.

The numbers tell a worrying story

At first sight, local-government revenue appears to have improved.

Locally generated recurrent revenue increased from approximately Rs. 28.1 billion in 2019 to Rs. 56.7 billion in 2024. That looks like a doubling within five years.

But inflation changes the picture completely.

When expressed in 2021 prices, the Rs. 56.7 billion collected in 2024 was worth only about Rs. 27.4 billion. Thus, despite the large nominal increase, local authorities had gained very little-and in this comparison actually had less-real purchasing capacity than the headline figures suggest.

This is particularly important because citizens judge local government not by nominal revenue figures but by whether roads are maintained, garbage is collected, drains are cleared and services are delivered efficiently.

Central revenue has recovered-but local revenue has not kept pace

The contrast with central-government taxation is even more striking.

Central-government tax revenue increased to about Rs. 3.70 trillion in 2024, and the provisional figure for 2025 was approximately Rs. 5.05 trillion. Local-government own recurrent revenue, however, amounted to only Rs. 56.7 billion in 2024.

Local own revenue represented around 3.1% of central tax revenue in 2020, when national revenue had fallen sharply, but by 2024 the ratio had declined to only 1.5%.

This does not mean that local government should collect some predetermined percentage of central taxes. It does show something more fundamental: Sri Lanka’s recovery in national tax mobilisation has not been accompanied by a comparable strengthening of the revenue capacity of the level of government closest to the citizen.

That imbalance deserves attention in Budget 2027.

Why are local authorities financially weak?

One reason is the narrow and outdated local tax base.

Rates and taxes accounted for only about 27.5% of locally generated recurrent revenue in 2024. Local authorities therefore depend on a mixture of rents, licence fees, service charges, fines and other receipts in addition to taxation.

Property taxation should be one of the strongest revenue instruments available to local government. Property is immovable, its value often rises with urban development and public infrastructure, and revenue collected from it can be visibly linked to improvements in the locality.

Yet the system suffers from outdated property valuations, incomplete coverage and administrative weaknesses. The underlying academic study, drawing on IMF analysis, points to precisely these constraints.

Consider how much Sri Lanka has changed physically during the past two decades. New houses, apartments, commercial buildings, hotels and business premises have appeared throughout urban and semi-urban areas. Land and property values have changed enormously.

But if valuation registers, property databases and collection systems do not keep pace with these changes, local government cannot capture even a reasonable share of the revenue potential created by development.

This is not simply a question of imposing higher taxes. It is fundamentally about modernising an outdated revenue administration system.

Not every local authority is equally capable

There is another important issue that Budget 2027 must recognise.

A Municipal Council in a commercially active urban area and a rural Pradeshiya Sabha do not have the same revenue base.

The 2024 figures illustrate the difference clearly. Municipal Councils generated enough own recurrent revenue to cover approximately 86% of their expenditure. For Urban Councils the figure was about 77%. For Pradeshiya Sabhas it was only around 56%.

Rates and taxes represented about 41% of Municipal Councils’ own recurrent revenue, but only about 12% for Pradeshiya Sabhas.

This means that simply telling every local authority to ‘raise more revenue’ is not a solution.

A commercially strong municipality has hotels, offices, shopping centres, high-value property and large businesses from which revenue can potentially be mobilised. A poorer rural Pradeshiya Sabha may have none of these.

Therefore, fiscal reform must combine two principles:

greater responsibility for raising local revenue, and greater fairness in distributing national resources.

Without the second, fiscal decentralisation could actually widen inequalities between richer and poorer parts of the country.

Transfers are necessary-but they should be predictable

Transfers from higher levels of government are therefore not necessarily a weakness. They are an essential component of a properly designed decentralised fiscal system.

During 2019-2023, government grants were equivalent to roughly 40-50% of total local-government expenditure. In 2024 the ratio rose to approximately 65%, largely because of unusually high capital grants.

The problem is not simply that transfers exist.

The real questions are: How are they determined? Are they predictable? Do poorer areas receive adequate support? Do transfers reward improved revenue collection and better service delivery?

These questions should become part of the Budget 2027 reform discussion.

Five reforms Budget 2027 could initiate

Budget 2027 does not have to redesign the entire local-government finance system overnight. But it can provide a credible starting point for reforms that have been delayed for too long.

First, modernise property taxation. Sri Lanka needs updated property registers and regular valuation cycles, supported by digital systems connecting valuation, billing, land information and payments. Better administration should come before simply increasing tax rates.

Second, strengthen local own-source revenue. Rates, licence fees and appropriate user charges should be reviewed and collection systems modernised. Digital billing and payment facilities can simultaneously increase revenue and reduce inconvenience, discretion and opportunities for leakage.

Third, introduce transparent formula-based transfers. Recurrent equalisation grants should be distinguished from development and performance grants. Local authorities should be able to anticipate their resource envelope rather than depending excessively on discretionary allocations.

Fourth, establish an explicit equalisation mechanism. Poorer Pradeshiya Sabhas cannot be expected to provide comparable basic services from much weaker tax bases. National transfers should therefore take account of population, fiscal capacity, service needs and other relevant indicators.

Fifth, build a national local-government fiscal information system. Sri Lanka should be able to see annually-and preferably digitally-how much each authority collects, receives and spends, together with indicators of tax effort and fiscal capacity. The academic analysis itself recommends a consolidated central-provincial-local fiscal database.

Revenue reform must also mean better services

There is an important warning.

Citizens will understandably resist paying higher rates and charges if they see no corresponding improvement in services.

Therefore, local fiscal reform should not become simply another revenue-raising exercise.

It should create a new relationship between local revenue, accountability and service delivery. When a council collects more efficiently, citizens should be able to see where the money goes and what improvements it finances.

Digital revenue systems should therefore be accompanied by transparent budgets, published performance indicators and stronger mechanisms for citizen participation.

The objective should be a virtuous circle:

better revenue ? better local services ? greater citizen confidence ? stronger willingness to pay ? greater local accountability.

Budget 2027 should begin the transition

Sri Lanka has undertaken painful national fiscal reforms following the economic crisis. Central-government tax mobilisation has strengthened considerably since 2022.

But strengthening Colombo’s revenue collection while leaving hundreds of local authorities financially weak cannot be the final destination of fiscal reform.

The evidence shows that locally generated revenue remains very small relative to national taxation; inflation has severely reduced its real purchasing power; the local tax base remains narrow; transfers finance a substantial part of expenditure; and Pradeshiya Sabhas are considerably weaker financially than Municipal and Urban Councils.

Budget 2027 therefore offers an opportunity to place local-government fiscal reform firmly on the national reform agenda.

The immediate objective need not be to transfer a large new tax burden to citizens or suddenly make every local authority financially self-sufficient. That would be neither realistic nor equitable.

The objective should instead be to build a modern system in which local authorities mobilise a reasonable share of their own resources, the Central Government provides transparent and predictable equalisation support, and citizens can see a clearer connection between what they pay and the services they receive.

Sri Lanka’s economic recovery will ultimately be experienced not only through national statistics but also in its cities, towns and villages. If decentralisation is to mean anything to an ordinary citizen, local institutions must have both the responsibility and the financial capacity to deliver.

Budget 2027 is an appropriate place to begin that long-delayed reform.

The 2nd Data Privacy and Protection Summit 2026, organised by CICRA and the Daily FT, concluded recently at the Oak Room, Cinnamon Grand Colombo, drawing over 380 senior professionals from data protection, governance, compliance, and cybersecurity sectors. The landmark event, supported by Mastercard as Title Partner, Concentric AI as Strategic Partner (in partnership with Orin Corporation), People’s Bank as Exclusive Banking Partner, and LankaPay as Silver Partner, provided a critical platform for understanding how AI enablement is transforming both the threat landscape and defensive capabilities.

The final session of the day, titled ‘Before the Breach: Why a Data Protection Impact Assessment (DPIA) Saves You from Disaster,’ featured powerful addresses from Brandix Apparel Ltd., Director Oshada Senanayake, and D. L. and F. De Saram Consultant Counsel Shenuka Jayalath, followed by a dynamic panel discussion that brought together regulatory, legal, and industry perspectives.

Delivering the keynote address, Oshada Senanayake presented a practitioner’s perspective on why DPIAs are not merely a regulatory checkbox but a strategic defence mechanism. ‘Before the breach is the only moment you get to choose your risks. After it, they choose you,’ he warned the packed audience.

Senanayake began by underscoring the urgency of the moment. With the Personal Data Protection Act (PDPA), No. 9 of 2022 enacted in 2022, the Data Protection Authority established in 2023, and the Amendment Act No. 22 of 2025 restructuring the grace-period regime, ‘organisational runway is ending,’ he stated. ‘Substantive obligations – controller duties, data subject rights, penalties – are becoming fully operational.’

He reminded the audience that the maximum administrative penalty per non-compliance stands at Rs. 10 million and it can double for repeat offences. ‘But the real cost of a breach, trust, remediation, litigation, dwarfs the fine. The law requires the assessment before processing begins, not after the breach.’

Oshada outlined the statutory triggers for a DPIA under Section 24 of the PDPA: systematic and extensive evaluation of personal data or special categories including profiling; systematic monitoring of publicly accessible areas or telecommunication networks; and further processing activities to be prescribed by rules. He noted that the draft DPIA Regulations add a risk matrix: probability × impact = 10 makes a DPIA mandatory.

The draft Regulations prescribe a formal process: a prescribed form (Schedule I) covering purposes, data categories, volumes, recipients, cross-border transfers, retention, and safeguards; impact mapped against every controller obligation (Sections 5-12) and every data subject right (Sections 13-19); DPO assistance in conducting the assessment; and consultation with the Authority where residual risk cannot be mitigated.

Oshada then shared five practical realities drawn from his boardroom experience:

Reality 1: You cannot assess what you have not inventorised. He advocated for a tiered approach, Tier 1 systems (HR, payroll, customer, and claims) requiring DPIA first; Tier 2 requiring monitoring and scheduling; Tier 3 screening at next change; and Tier 4 requiring only registration. ‘Inventory every solution touching personal data – in-house, vendor, and the spreadsheets nobody admits to,’ he urged. ‘Most failed programs trace back to inventories that were out of date before the ink dried.’

Reality 2: Don’t wait for perfect guidance – borrow proven scaffolding. With the Data Protection Authority newly established and the DPIA Regulations still in draft, Senanayake advised organisations to design to the draft Schedule I form now. ‘Waiting is a decision and it is the wrong one, because processing is happening today,’ he cautioned. He recommended leveraging global frameworks: the EDPB/WP248 nine criteria for judging ‘high risk,’ the UK ICO’s practical DPIA template, CNIL’s free open-source PIA software, and ISO/IEC 29134.

Reality 3: Assemble the right room – a DPIA is a team sport. Oshada stressed that a DPIA requires the product/process owner, technical and data teams, cyber security, risk and control, legal/compliance, and the DPO from day one, not at the end. ‘If the DPIA is one officer filling a form alone, it is already a rubber stamp.’

Reality 4: In-house vs vendor-driven two different playbooks. For built-in-house systems, embed the DPIA into design and build gates (privacy by design). For vendor-driven systems, assess through due-diligence questionnaires, certifications, and audits and negotiate mitigations into contracts. ‘A DPIA is not just a defence document; it is negotiating leverage,’ he said, citing the Dutch government’s DPIAs on Microsoft 365 that resulted in legal, technical, and product changes from one of the world’s largest vendors.

Reality 5: The bandwidth problem design around it. Oshada acknowledged that the best people are already consumed by BAU and digital transformation. His solution: screen first with a 15 minute threshold questionnaire at project intake; embed the DPIA as a stage-gate inside existing project and procurement workflows; reuse DPIAs ruthlessly rather than assessing the same cloud platform multiple times; and protect the DPO ‘the DPO orchestrates and challenges he business owns and writes.’

Oshada concluded with a seven-point playbook: inventorise and tier every system touching personal data; adopt one methodology now mapped to the draft Schedule I form; screen at every gate with a threshold questionnaire; assemble the right room; split the tracks for in-house and vendor-driven systems; keep the DPIA alive with reviews on material change; and escalate honestly , ‘Residual risk still high? Consult the Authority before processing, not after the breach.’

‘A DPIA done on paper is a document. A DPIA done in practice is a defence,’ he concluded.

Real-world case studies

Shenuka Jayalath delivered a compelling presentation titled ‘Assess, Don’t Guess,’ reinforcing the proactive power of DPIAs through real-world case studies.

Shenuka defined a DPIA as a risk management procedure used by organisations to identify, evaluate, and mitigate privacy risks before launching new products, technologies, or projects that process personal data. ‘DPIAs help organisations avoid compliance issues and prevent harm to individuals by proactively addressing risks,’ she explained. ‘They also demonstrate accountability to the Data Protection Authority and build trust with customers.’

She provided practical examples of when a DPIA is triggered: using AI to track customer behaviour and profile them for targeted ads; rolling out facial recognition; and hospitals handling thousands of patient health records. ‘If unsure whether a project requires a DPIA, err on the side of caution – perform at least a preliminary risk assessment,’ she advised.

Shenuka then walked the audience through four cautionary tales from around the world:

Mercadona Supermarkets (Spain) The supermarket chain deployed facial recognition in 48 stores to identify individuals with restraining orders. The DPIA failed to assess proportionality to catch 10 banned people, they unlawfully captured the biometric data of hundreds of thousands of innocent shoppers, including children. Result: pound 2.5 million fine and forced dismantling of the entire system. ‘A proper DPIA would have caught this at the design stage, saving them millions.’

Clearview AI (Global) The company scraped billions of facial images from public platforms to create a massive biometric database, falsely assuming that because the original photos were ‘publicly available,’ they did not need a DPIA. The UK ICO explicitly cited the failure to conduct a DPIA as a core statutory breach. Result: £7.5 million fine (UK ICO) and enforcement notices from French, Italian, and Dutch authorities. ‘Applying AI to extract biometric profiles creates entirely new, high-risk data processing that legally mandates an impact assessment.’

Deliveroo (Italy), The food delivery platform used an AI-driven algorithm to manage its workforce, systematically monitoring rider performance and assigning shifts. The Italian regulator fined Deliveroo pound 2.5 million, explicitly citing the complete failure to conduct a DPIA. The AI penalised riders for legitimate absences such as illness, indirectly processing health-related data without human oversight. ‘Without a DPIA, Deliveroo could not explain the logic of the AI system to its workers, violating transparency and fairness.’

The Meta Pixel Crisis, Major hospital networks in the US and UK installed Meta Pixel tracking code on patient portals without DPIAs. The code scraped patients’ private medical conditions, appointment types, and doctors’ names, sending it all to Meta for targeted advertising. ‘Hospitals that conducted a DPIA mapped the data flow, saw health data was going to Meta, and blocked the pixel before it went live. Those that skipped the DPIA faced multi-million dollar class-action settlements.’

Shenuka also highlighted another examples where DPIAs averted catastrophe:

UK NHS COVID-19 App, The UK Government initially planned a centralised model for contact tracing, where location logs and health status would be uploaded to a single government database. The DPIA revealed that a centralised database holding health and location data of an entire country would become the prime target for hackers and failed the ‘data minimisation’ test. Result: The government scrapped the centralised approach entirely and pivoted to a decentralised model, saving the UK from what experts warned would have been the most dangerous health data vulnerability in British history.

Shenuka identified common mistakes: not collecting the information needed (business process details, technology, PII collected, data flows, security features, storage, retention, third-party access); failing to update the DPIA as a living document; and failure to consider all stakeholders, ‘Leaving the DPIA solely to the legal team or DPO ignores IT, cybersecurity, product, and data science teams who understand the technical reality.’

She outlined a 7-step DPIA process: Identify the need (does this trigger high-risk criteria?); Describe the processing (the data lifecycle); Consult stakeholders (DPO, IT, security, vendors); Assess necessity and proportionality (is there a less intrusive way?); Identify and assess risks (what if data is hacked, leaked, or altered?); Design mitigating measures (encryption, access controls, data minimisation); and Sign-off (document decisions, escalate if residual risk remains high).

‘Proactive risk assessment prevents Rs. 10 million mistakes,’ Shenuka concluded.

Following the addresses, a dynamic panel discussion brought together regulatory, legal, and industry experts. Moderated by Pyramid Wilmar Ltd., Group Head of Legal Thamali Tennakoon, the panel featured: Oshada Senanayake, Shenuka Jayalath; Former Securities and Exchange Commission Chairman and CA Sri Lanka Past President Ranel T. Wijesinha and Hatton National Bank PLC Data Protection Officer Shenalie Wijeyeratne.

Ranel T. Wijesinha brought a regulatory and governance perspective, drawing on his extensive experience at the SEC and CA Sri Lanka. He emphasised that data protection is fundamentally a governance issue that demands attention at the highest levels of corporate leadership. ‘Directors and boards cannot delegate data protection to IT alone – it is a strategic risk that requires board-level oversight,’ he stressed. He noted that DPIAs serve as critical tools for directors to demonstrate they have exercised reasonable care in overseeing data processing activities, and that failure to conduct proper assessments could expose boards to liability under the PDPA’s penalty provisions.

Shenalie Wijeyeratne shared the practical realities of implementing DPIAs within a large financial institution. Drawing on her experience as DPO at HNB, she highlighted the challenges of identifying high-risk processing activities across a sprawling banking operation. ‘In a bank, personal data flows through countless systems, core banking, loan origination, credit scoring, fraud detection, and customer relationship management,’ she explained. ‘The challenge is not just conducting the DPIA, but building the inventory and data mapping that makes it possible.’ She emphasised that financial institutions must prioritise DPIAs for systems involving credit scoring and automated decision-making, as these carry heightened risks for customers.

Oshada Senanayake reinforced the importance of the tiered approach he had outlined in his keynote, noting that organisations must be realistic about their capacity to conduct DPIAs. ‘You cannot do everything at once. Tier your systems based on business criticality and personal-data exposure, and build a sequenced DPIA pipeline,’ he advised. He also stressed that DPIAs must be embedded into existing project and procurement workflows rather than treated as standalone exercises.

Shenuka Jayalath addressed the legal dimensions, noting that the draft DPIA Regulations provide a useful framework but that organisations should not wait for finalisation. ‘The draft Schedule I form gives you a clear indication of what the Authority expects, purposes, data categories, volumes, recipients, cross-border transfers, retention, safeguards,’ she said. ‘Design to that now, and you won’t have to rework when the Regulations are gazetted.’

The panel explored several key themes:

n Board accountability: Ranel stressed that DPIAs are not just operational tools but governance instruments. ‘When a breach occurs, the first question regulators ask is: ‘What did you know, and when did you know it?’ A properly conducted DPIA is the answer.’

Proportionality: Shenalie noted that one of the most common DPIA failures is the failure to assess proportionality – as seen in the Mercadona case. ‘Just because you can process data doesn’t mean you should. DPIAs force organisations to ask that question.’

Vendor management: The panel agreed that vendor-driven systems present unique challenges. Oshada noted that organisations must conduct due diligence on vendors and ensure contracts include DPIA cooperation clauses. ‘Your statutory obligation does not stop at your vendor’s door.’

Living documents: All panellists emphasised that DPIAs must be reviewed on material change. ‘Systems change, vendors add AI features, purposes drift – an assessment frozen at go-live is stale within a year,’ Oshada warned.

DPO empowerment: Shenalie stressed that the DPO must be involved from day one. ‘The Act expects the DPO›s assistance – not a signature at the end. If the DPIA is one officer filling a form alone, it is already a rubber stamp.’

The session concluded with a powerful consensus: DPIAs are not merely a regulatory requirement, they are a strategic defence that can save organisations from financial ruin, reputational damage, and regulatory penalties.

‘Before the breach is the only moment you get to choose your risks. After it, they choose you,’ Oshada reminded the audience.

With the PDPA enforcement date fast approaching, the message from the summit was clear: organisations must move beyond reactive compliance and embrace proactive risk assessment. ‘A DPIA done on paper is a document. A DPIA done in practice is a defence,’ Oshada concluded.

Cinnamon Grand was the Hospitality Partner of The Data Protection and Privacy Summit and MullenLowe Sri Lanka was the Brand Communications Partner.

Manchester City have agreed to pay a joint-British transfer record fee of £ 125 million for Chelsea midfielder Enzo Fernandez.

Fernandez joined Chelsea from Benfica in 2023 for a then-British record fee of £107m, with his latest switch matching the £ 125 million that Liverpool paid for Alexander Isak on this day last summer.

The clubs have been negotiating over the past 24 hours and have now reached an agreement.

Fernandez will now undergo a medical ahead of signing a long-term deal at City. Personal terms will not be an issue.

Argentina international Fernandez worked with City manager Enzo Maresca during the Italian’s reign at Chelsea.

Maresca is keen to work with him again after losing a host of midfielders this summer.

Fernandez was not involved in Chelsea’s 4-3 Premier League win over Brighton on Sunday or their 2-0 Carabao Cup victory against Luton three days earlier, as reports in Argentina suggested he asked to be left out of the squad.

It is the second time this summer that City have broken their own transfer record, following the £ 116 million arrival of Elliot Anderson from Nottingham Forest.

Fernandez becomes the fourth player to move to a Premier League club for a fee of at least £ 100 million this summer – following Morgan Rogers (£ 117 million) to Chelsea, Bradley Barcola to Liverpool (£ 123 million) and City’s signing of Anderson.

Sri Lanka’s export sector could face additional pressure in the coming months from dry weather conditions due to El Niño, particularly across agriculture-linked exports, Export Development Board (EDB) Chairman and CEO Mangala Wijesinghe warned.

Addressing the media on Monday, he said the tea, fruits, and vegetables, as well as any other crops sectors, could experience downward pressure as weather conditions deteriorate, with the potential impact compounded by the effects of El Niño.

‘Tea is already facing a difficult external environment, with the Middle East crisis disrupting an important destination market. Around 35% of Sri Lanka’s tea exports are directed to Middle Eastern markets, making the sector particularly vulnerable to geopolitical and shipping disruptions in the region,’ he said.

During the first seven months of 2026, earnings from tea exports declined by 7.53% year-on-year (YoY) to $ 817.53 million, with Bulk Tea exports falling 9.89% and Tea Packets declining 7.01%.

From January to July, vegetable exports declined by 14.66% YoY to $ 17.64 million, while fruits and nuts fell by 12.28% YoY to $ 23.78 million.

Wijesinghe said any further deterioration in weather conditions could add another layer of pressure to agricultural exports.

He pointed out that the most effective response was to diversify both the export basket and markets, allowing stronger-performing products and emerging sectors to offset weakness elsewhere.

‘We have already commenced implementation of the National Export Development Plan (NEDP) which was launched in June, with an objective of achieving around 8-10% annual export growth,’ he said.

The EDB Chief said over 35 Government institutions are involved in implementing the plan, while the EDB is monitoring the performance of eight priority sectors to ensure measurable progress.

These sectors include auto components, minerals-based industries, rubber-based industries, marine-based industries including boat and shipbuilding, spices and concentrates, digital products and services, electrical and electronic components, and processed food and beverages.

The National Biotechnology Industry Association (NBIA) successfully conducted its first Annual General Meeting (AGM) on 20 August 2026 at the Sri Lanka Institute of Biotechnology (SLIBTEC), marking an important milestone in the establishment and development of Sri Lanka’s biotechnology industry association.

The AGM brought together members and key stakeholders from Sri Lanka’s biotechnology and related sectors to review the Association’s activities and progress since its establishment and to discuss the way forward for strengthening the national biotechnology ecosystem.

The meeting provided an opportunity for members to deliberate on matters relating to the development of the biotechnology sector, strengthening collaboration among industry stakeholders, and creating an enabling environment to support innovation, investment, research, and commercialisation within Sri Lanka’s biotechnology industry.

The Association further emphasised the importance of strengthening collaboration between industry, research institutions and other relevant stakeholders to facilitate the transfer of knowledge and technology and to promote the application of biotechnology in areas of national economic importance.

The first AGM also served as a platform to reaffirm NBIA’s commitment to representing and promoting the interests of Sri Lanka’s biotechnology sector and supporting the development of a competitive, innovative and sustainable biotechnology ecosystem. The Association looks forward to working closely with its members, government institutions, research and academic institutions, private sector organisations and other stakeholders to advance the biotechnology sector and contribute to Sri Lanka’s broader economic and technological development.

The World Bank is supporting to transform Colombo into a destination in its own right and attract higher-spending visitors who currently spend only a fraction of their trip in the capital.

World Bank Lead Private Sector Specialist – South Asia Region, Finance, Competitiveness and Innovation Global Practice Natasha Kapil said the Bank’s analysis had identified a significant untapped opportunity in Colombo, despite the city having the country’s largest concentration of five-star hotel rooms.

‘Somewhere between 5% and 10% of visitors to Sri Lanka actually stay in Colombo, while the average length of stay is only about half a day,’ she said.

Speaking at the launch of the National Tourism Strategic Plan for 2026-2031, alongside a five-year Global Destination Communication Campaign Road Map being developed with international and local consultants under the World Bank’s Grant Facility for Project Preparation (GFPP) on Monday, she said the branded THRIVE Colombo project would be the first of three planned operations, followed by interventions focused on nature-based and marine tourism.

The combined envelope for the three operations is approximately $ 200 million, with Tourism for Heritage, Resilience, Inclusion, and Value-driven Employment (THRIVE) Colombo accounting for around $ 77 million.

‘This is much more than a tourism project,’ Kapil said, describing THRIVE as a platform for the Government’s wider tourism agenda, encompassing investment as well as policy reforms.

The World Bank’s decision to start with Colombo is based on what Kapil described as a significant untapped opportunity, turning the capital from largely a transit or gateway city into a destination capable of attracting higher-spending international travellers for 48 to 72-hour stays, weekend breaks and short trips.

‘We believe there is a strong case for establishing Colombo as a destination in its own right,’ she said.

The proposition is particularly significant given the city’s substantial concentration of high-end accommodation. ‘Colombo has the largest inventory of five-star hotel rooms in Sri Lanka, yet the proportion of international tourists staying in the city remains remarkably low,’ she said, adding that the World Bank therefore sees the opportunity not necessarily in building more hotel capacity, but in making the city itself sufficiently attractive for high-end visitors to stay longer and spend more.

She said potential activities such as performing and digital arts, Kala Pola, Colombo Fashion Week, literature festivals and other events capable of attracting higher-value visitors.

THRIVE Colombo will combine institutional reform, destination infrastructure and private-sector investment.

‘Two major tourism ‘loops’ have been identified as the initial physical development opportunities; a Fort-centric loop and a nature-centric loop around Colombo’s wetlands,’ she said.

According to her, the Fort concept connects the waterfront, Galle Face Green, the heritage buildings in Fort area along the attractions extending towards Pettah, while the nature loop would build on assets such as Beddagana Wetland Park and Diyasaru Park.

Investment could cover site and building upgrades, pedestrianisation and missing connections between attractions, with the aim of turning currently fragmented assets into coherent visitor experiences.

‘We have identified several heritage buildings in the Colombo Fort area that could be considered for new tourism activities. But equally, we are very keen to ensure that the private sector participates in managing and operating selected tourism assets, rather than leaving the responsibility entirely with the Government,’ Kapil added.

The strategy also recognises the need for a Tourism Entrepreneurship Fund to finance the ‘software’ of the destination, the enterprises, events, creative activities and experiences that can give visitors reasons to stay longer.

She said this fits closely with the emerging direction of Sri Lanka’ National Tourism Strategic Plan for 2026-2031, which is seeking to move the industry from volume to value.

The World Bank is also backing institutional changes intended to support that transition. Under THRIVE Colombo, the Sri Lanka Tourism Development Authority (SLTDA), Sri Lanka Tourism Promotion Bureau (SLTPB) and Sri Lanka Institute of Tourism and Hotel Management (SLITHM) are expected to undergo modernisation, including improvements to digital systems, governance, human resources and data collection. The move will also support tourism skills development, including a review and modernisation of tourism education and training.

She said the initiative also places keen emphasis on the new Tourism Act, under the leadership of the Tourism Ministry as better tourism intelligence will be critical as Sri Lanka seeks to identify changing source markets and target higher-spending travellers.

She said a further component will be the preparation of a National Tourism Strategic Plan for 2026-2031, supported by demand and supply assessments, destination-level planning, investment and regulatory reviews and a tourism skills-gap assessment.

This evidence base is also expected to improve tourism promotion.

Kapil said Sri Lanka’s current promotional efforts could eventually become more targeted once better market intelligence is available, allowing the country to develop campaigns aimed specifically at higher-spending segments for Colombo, as well as distinct segments for nature-based tourism.

‘This could represent a departure from broad-based destination marketing towards product- and segment-led promotion,’ she added.