Sri Lanka has opportunity to lead the world’s next digital revolution

Sri Lanka has already taken the legislative step. The Personal Data Protection Act, No. 9 of 2022 is an important milestone, and it places the country among the early movers in South Asia. But legislation alone does not protect information. Laws define obligations; technology determines whether those obligations can realistically be met

Standfirst: Laws define obligations; technology determines whether they can be met. Sri Lanka can be one of the first nations to treat verifiable digital trust as national infrastructure.

For decades, nations have invested in roads, ports, airports and telecommunications because they understood a simple truth: economic growth depends on trusted infrastructure. A container port works because the manifest can be believed. A banking system works because the ledger is accurate. A land title has value because the record behind it is sound. Infrastructure is, at bottom, a machine for producing confidence between strangers — and confidence is what commerce is made of.

Today a new form of infrastructure is emerging. It is built not from concrete and steel but from cryptography, digital identity, secure data management and verifiable trust. 

Sri Lanka has an opportunity to become one of the first nations to treat it the way an earlier generation treated electrification: not as a technology purchase, but as national infrastructure.

Past decade of the digital economy 

Consider what the past decade of the digital economy has actually taught us. Almost every major data breach, on every continent, has shared a single root cause: an organisation held information it could read, and someone else got in. The names change — a telecommunications provider one year, a health insurer the next, a credit bureau the year after — but the architecture of failure is identical. We built the digital economy on custodians: institutions that hold our data in readable form and promise to protect it. Each of those promises is only as strong as the custodian’s weakest credential on its worst day.

This is not an argument that institutions are careless. Many of the organisations breached in recent years spent heavily on security and employed capable people. It is an argument that the custodial model itself is reaching its limits. Data held in readable form is a target precisely because it is readable; and once it is exposed, no remediation is possible — information, unlike money, cannot be recalled. Cyber-attacks, AI-assisted intrusions and ransomware are growing in sophistication faster than defensive spending can answer. The challenge is no longer simply keeping data secure. It is proving that information can be trusted at all.

Sri Lanka has already taken the legislative step. The Personal Data Protection Act, No. 9 of 2022 is an important milestone, and it places the country among the early movers in South Asia. But legislation alone does not protect information. Laws define obligations; technology determines whether those obligations can realistically be met. A statute can require an organisation to safeguard personal data. It cannot, by itself, change the architecture that makes that data vulnerable.

It is a genuine structural advantage. There is an economic dimension as well. Trust, once it becomes demonstrable, becomes exportable. The jurisdictions that can prove the integrity of their records, their registries and their data flows will find it easier to attract the industries that depend on such proof — financial services, health research, digital trade

Class of technologies 

There is now a class of technologies that changes what is realistic. Zero-knowledge proofs — a cryptographic method by which one party can prove a statement is true without revealing the information behind it — together with decentralised identity and privacy-preserving verification, allow organisations to verify what they need to know without exposing what they hold. The shift sounds technical, but it is conceptually simple and profound: from trusting institutions to verifying facts.

What does that mean in practice? A hospital can prove a patient’s record is intact and unaltered without building a central archive that becomes a national target. A bank can verify a customer’s identity without warehousing copies of the documents that prove it. A land registry entry can carry mathematical proof of its own integrity. A Government service can confirm a citizen’s entitlement without duplicating the citizen’s file into yet another database. In each case, compliance becomes easier to demonstrate, audit trails become stronger, and privacy stops being a policy promise and becomes a property of the system itself.

Well placed to move early

Sri Lanka is unusually well placed to move early, for a reason that is easy to miss: it carries less legacy than the economies it is often compared with. Nations that digitised first are now locked into decades of custodial architecture — sprawling systems that must be painstakingly retrofitted. Sri Lanka has repeatedly demonstrated an ability to leapfrog traditional development pathways, moving directly to the current generation of technology rather than replicating the last one. The national systems now being designed and modernised — in healthcare, finance, land administration and digital Government — can be born verifiable, rather than expensively converted later. That is not a consolation prize for late development. It is a genuine structural advantage.

There is an economic dimension as well. Trust, once it becomes demonstrable, becomes exportable. The jurisdictions that can prove the integrity of their records, their registries and their data flows will find it easier to attract the industries that depend on such proof — financial services, health research, digital trade. And the standards for this new infrastructure are being written now. Countries that adopt early do not merely benefit from the technology; they help set the norms that others will later adopt. A nation of Sri Lanka’s size cannot outspend the large economies, but on infrastructure of this kind it does not need to. It needs to move earlier and commit more clearly.

None of this requires a leap of faith in any single product or vendor, and it should not be built on one. It requires something governments already know how to do: treat a foundational capability as infrastructure, set standards for it, and let public systems lead by example.

The next digital revolution will not be defined only by artificial intelligence. Artificial intelligence, if anything, raises the stakes of an older question — whether the data underneath can be trusted at all. The nations that invest in trusted digital infrastructure today will shape the digital economy for decades to come. Sri Lanka has every opportunity to be one of them.

The next digital revolution will not be defined only by artificial intelligence. Artificial intelligence, if anything, raises the stakes of an older question — whether the data underneath can be trusted at all. The nations that invest in trusted digital infrastructure today will shape the digital economy for decades to come. Sri Lanka has every opportunity to be one of them

(The author is Managing Director of Future CX Pty Ltd, an Australian digital-infrastructure company with engineering operations in Colombo, Sri Lanka. Future CX builds privacy-preserving data infrastructure using zero-knowledge proofs. He is a director of companies across property, manufacturing and construction and Seniors living in Australia)