160-page guide translates the Personal Data Protection Act into an actionable framework for private and public-sector organisations

Xapi, the unified governance platform spanning Data, API and AI Governance, today announced the launch of the Xapi Personal Data Protection Compliance Playbook, a practical implementation guide designed to help Sri Lankan organisations translate the Personal Data Protection Act into structured, operational and evidence-ready governance.

The launch comes as organisations across Sri Lanka prepare for the next phase of PDPA implementation, with core provisions scheduled to come into effect from 1 January 2027.

Developed as an implementation resource, the approximately 160-page Playbook centres on Xapi's six-layer implementation framework and a four-level maturity model that allows organisations to assess their current state, identify priority gaps and determine what to address next. It also includes a Sri Lankan enterprise case study, leadership checklist and PDPA Gap and Readiness Audit.

Prabath Ariyarathna, CEO and Chief Architect of Xapi, said the challenge facing organisations is increasingly one of implementation rather than awareness.

"There has been considerable discussion around what the PDPA requires, but the real challenge is operationalising it. Compliance cannot live only in policies or spreadsheets; organisations need visibility into their data and the controls applied to it.This Playbook helps make that transition from understanding the law to building evidence-ready governance in practice."

Shanaka Mendis, Head of Sales at Xapi, said the Playbook is intended to give organisations a practical starting point.

"Many organisations know PDPA readiness matters, but the question we hear most is, 'Where do we start?' The Playbook gives leaders and compliance teams a common framework to assess their position and build a roadmap towards compliance."

By combining education, assessment and implementation guidance in one resource, Xapi aims to help organisations move beyond interpretation of the Act towards a practical question: whether they can consistently govern personal data, apply controls and produce evidence that those controls are working.

Prabath Ariyarathna, CEO and Chief Architect of Xapi, speaking at the launch of the Xapi Xapi Personal Data Protection Compliance Playbook

Photo Caption : Prabath Ariyarathna, CEO and Chief Architect of Xapi, hands over a copy of the Xapi Personal Data Protection Compliance Playbook to Chanaki Mallikarachchi, Director of the Ministry of Digital Economy