Section 18.2 of the Computer Crime Act confers authority upon a designated expert or police officer to obtain information—such as subscriber details and traffic data—held by a service provider, and to intercept wire or electronic communications without a warrant, provided that the following conditions are met: (i) the investigation must be conducted with urgency; (ii) there exists a substantial risk that evidence may be lost, destroyed, altered, or rendered inaccessible; and (iii) the preservation of confidentiality is necessary.
For the Act, the term "expert" denotes a public officer possessing the requisite qualifications and experience in electronic engineering or software technology, who is appointed by the Minister responsible for science and technology, in consultation with the Minister of Justice, through an order published in the Gazette. The term "service provider" encompasses any public or private entity that enables its clients to communicate via a computer system, as well as any entity that processes or stores computer data or information on behalf of such a provider or its clients.

Section 33 of the Online Safety Act confers upon experts appointed to assist the Online Safety Commission the authority, for an investigation under the Act, to access any information system, computer, or computer programme, as well as any data or information contained therein, to perform their designated functions. Additionally, such experts are empowered to compel individuals to disclose traffic data. Notably, it has been reported that these investigatory powers do not require the issuance of judicial warrants to access user data.
It is reported that the enforcement of the Online Safety Act was halted in January 2025. The Government announced that it would not enforce the Act in its current form and that it would be implemented following modifications.

A basic legal framework on intermediary liability for copyright infringement is absent in Sri Lanka's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Sri Lanka's law and jurisprudence.
Section 27 of the Online Safety Act establishes a safe harbour regime for intermediaries regarding the dissemination of 'prohibited statements'. It provides that any individual or entity engaged in the provision of services such as internet intermediation, telecommunications, public internet access, computing resources, email, short messaging services (SMS), multimedia messaging services (MMS), or one-to-one live aural communication shall not be held liable for the dissemination of a prohibited statement transmitted through an online platform owned, operated, or controlled by such a provider. Nor shall they be liable for enabling end users to access, via such a platform, a communication link containing a prohibited statement authored by a third party. In addition, where a false or prohibited statement, or other unlawful material, is removed within six months of the Act’s commencement, or where such material has been uploaded or tampered with by third parties, neither the owner of the online account nor the internet service provider shall bear liability in relation to the content in question.
It is reported that the enforcement of the Online Safety Act was halted in January 2025. The Government announced that it would not enforce the Act in its current form and that it would be implemented following modifications.

It is reported that an ICT Agency's decision requires the provision of a citizen’s national identity card number to access to public Wi-Fi hotspots.

Under Section 3 of the “Subscriber SIM Cards (Subscriber Identification Modules - SIM) Regulations No. 01 of 2019”, every operator shall comply with the regulatory measures specified in Schedules I and II for the registration of SIM cards of retail and corporate subscribers, respectively. Under Schedule I, each operator must obtain a duly completed and signed application form from the retail subscriber, including the following mandatory details: national identity card number, permanent address, and new telephone number. Under Schedule II, each operator must ensure that the application is accompanied by a true copy of the certificate of business registration and a list containing the name, national identity card number or driving licence number or passport number, permanent address, and present address of the employees of the corporate subscriber who are obtaining connections under the corporate package.
In accordance with Schedules I and II of the "Subscriber SIM Cards (Subscriber Identification Modules – SIM) Regulations No. 01 of 2019", all licensed digital cellular mobile service providers are mandated to retain subscriber information and furnish such data to the relevant authorities upon request. Notably, the Regulations do not specify a specific retention period for this data.

Reports indicated that several independent and other websites were subject to access restrictions in 2024. In addition, in April 2022, the Telecommunications Regulatory Commission reportedly suspended access to various social media platforms in Sri Lanka at the Ministry of Defence's direction. The services affected included Facebook, YouTube, Twitter, Instagram, and WhatsApp. This suspension was lifted after 15 hours. A similar restriction was imposed in 2019, during which access to platforms such as Facebook, Facebook Messenger, Viber, Snapchat, and Instagram was blocked. Additionally, the use of the TunnelBear Virtual Private Network (VPN) was also restricted.

Sri Lanka currently lacks a comprehensive legal framework dedicated to the robust protection of trade secrets. Nonetheless, certain limited provisions address aspects of this issue. The principal legislative instrument governing matters related to unfair competition and the protection of undisclosed information, including trade secrets, is the Intellectual Property Act, No. 36 of 2003. This Act affords statutory protection to individuals and entities seeking legal redress against the unauthorised disclosure, acquisition, or utilisation of confidential information. In addition to statutory remedies, common law avenues remain accessible for the enforcement of rights in such cases. However, the existing legal regime does not provide for the formal registration of trade secrets.

Under Section 17.10 of the Telecommunications Act, as amended in 2024, the Commission shall have the authority to issue directions to any operator to whom a licence has been issued, requiring the sharing of any infrastructure owned or used by such operator with another operator specified by the Commission. The Act’s definition of infrastructure includes passive infrastructure.
Section 7 of the Telecommunications Infrastructure Sharing Regulations, released in 2024, states that these Regulations establish an infrastructure-sharing regime that enables the sharing of applicable telecommunications infrastructure among requesting operators, sharing operators, and owning operators.

The government holds an equity stake in a telecommunications company, with the Secretary to the Treasury possessing 50.2% of the issued share capital of Sri Lanka Telecom PLC as of 2024.

Pursuant to Section 11 of the Competition Rules, in instances where the telecommunications market is determined to lack effective competition, the Telecommunications Regulatory Commission of Sri Lanka (TRCSL) is mandated to identify entities possessing significant market power. Upon such identification, the Commission shall impose appropriate regulatory obligations on these entities to remedy the identified deficiencies in market competitiveness. In addition, the Commission will assess, on a case-by-case basis, the necessity of implementing accounting and functional separation measures, taking into account the specific circumstances and characteristics of each case.

The licensing of the telecommunications sector is regulated under Part II of the Sri Lanka Telecommunications Act, No. 25 of 1991, as last amended in July 2024. The Telecommunications Regulatory Commission of Sri Lanka (TRCSL) considers applications on a case-by-case basis, taking into account the market dynamics, competition and other sectoral factors. No new telecom licenses have been issued in the last 10 years. It is reported that TRCSL has a documented history of failing to be transparent in its recommendations on the issuance of licences to telecommunications providers.

Sri Lanka has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Sri Lanka possesses a national telecommunications regulatory body, namely the Telecommunications Regulatory Commission of Sri Lanka (TRCSL). Nevertheless, concerns have been raised regarding the extent of its institutional independence from governmental influence. Reports indicate a persistent pattern of governmental interference in the Commission’s decision-making processes. In addition, since the Ministry of Technology's organisational restructuring in October 2022, the TRCSL has operated under the purview of this Ministry.

Sri Lanka has entered into an agreement that entails binding commitments to permit the cross-border transfer of data. Art. 9.9 of the "Free Trade Agreement between the Democratic Socialist Republic of Sri Lanka and the Republic of Singapore" stipulates that each party shall allow the transfer of information by electronic means, including personal data, across borders when such transfers are necessary for the conduct of business by a covered person.