VPNs with servers in Sri Lanka

A service provider must keep a request confidential (s. 24(2)); failing to assist carries a fine of up to Rs 200,000, imprisonment of one to two years, or both (s. 23(2)). The Minister may prescribe by regulation how data is retained and intercepted (s. 18(4)). The Online Safety Act, No. 9 of 2024 repeats the warrant power for its own offences (s. 35). Whether these laws reach a VPN operator is not established.

A private member’s bill to repeal the Online Safety Act, No. 9 of 2024 was published in the Gazette in April 2025 and presented to Parliament on 8 May 2025.

The Online Safety Commission may issue notices to any internet service provider or internet intermediary to disable access, for end users in Sri Lanka, to an online location containing a prohibited statement, or to remove it (s. 11(c)). An “internet intermediary service” includes one that transmits third-party material to end users. Providers of such services are exempt from liability for a prohibited statement circulated through their location (s. 27(1)).

The Commission has five members, appointed by the President with the approval of the Constitutional Council (s. 5).

Communicating a false statement that threatens national security, public health or public order, or promotes ill-will between classes of people, carries up to five years or a fine of Rs 500,000 (s. 12). Further offences cover false statements amounting to contempt of court, wanton provocation, wounding religious feelings, and online cheating (ss. 13–17).

The account behind a post is reached by a Magistrate’s warrant for subscriber information (s. 35), or, for a statement posted from an inauthentic account or bot, by a District Court order to the intermediary to disclose the identity or location (s. 26).

The Computer Crime Act requires a Magistrate’s warrant for interception and for obtaining traffic data, but its section 18(2) removes the warrant where an officer judges the investigation urgent, and its confidentiality duty (s. 24(2)) keeps the request from the person concerned.

In observations of 12 September 2025 the International Commission of Jurists listed the overly broad powers of the Commission and of appointed experts among its concerns and urged repeal or substantial revision. The order of the rows is the security score, and a server’s location is not a recommendation.