The Director’s new reality: PDPA, cyber risk and personal liability in 2026

Thursday, 23 July 2026 00:00 -     - {{hitsCtrl.values.hits}}

 


 

  • A perspective from Delmege Insurance Brokers

As the Sri Lanka Institute of Directors (SLID) celebrates 25 years of advancing corporate governance under the theme “Future-Ready Sri Lankan Directors - From Compliance to Sustainable Growth,” Delmege Insurance Brokers congratulates the Institute on this significant milestone and its enduring contribution to strengthening board leadership in Sri Lanka.

The theme is particularly relevant today. Governance is no longer simply about complying with regulations, it is about building resilient organisations that can manage emerging risks while creating sustainable value. One question is becoming increasingly important in every boardroom:

Who protects the people who lead?

In 2026, Directors face growing personal accountability for decisions relating to data privacy, cyber security, digital transformation and regulatory compliance. Increasingly, the consequences of these decisions extend beyond the organisation and directly affect individual Directors.

Three risks every Board must consider

1.Personal Data Protection Act (PDPA) No. 9 of 2022

Sri Lanka’s PDPA places responsibility not only on organisations but also on those responsible for governance. Following a data breach, regulators will assess whether the board exercised appropriate oversight and implemented adequate safeguards. Directors may be personally named in investigations, even where a breach originates through a third-party service provider.

2. Companies Act No. 7 of 2007

Sections 198 and 220 require Directors to act with due care, skill and diligence. Failures in governance, inaccurate disclosures or regulatory breaches can expose Directors to personal liability. Certain penalties cannot legally be indemnified by the company, and serious breaches may even result in disqualification from serving as a Director.

3.Cyber and Reputational Risk

As organisations embrace digital transformation, boards are increasingly exposed to ransomware attacks, phishing, data theft and reputational damage. Shareholders, customers and regulators are also more willing to pursue legal action directly against Directors. Even where Directors are ultimately cleared, legal defence costs can be substantial.

Where company protection ends

Many Directors assume their company will always protect them. In reality, that protection has limits.

Directors may face legal action personally even after leaving office. If the company is financially unable to indemnify them, or where the law prohibits indemnification, legal costs and settlements become the Director’s personal responsibility. This creates a governance gap that many organisations have yet to address.

Protecting Boards in a changing risk environment

At Delmege Insurance Brokers, we believe effective governance extends beyond compliance. It includes protecting the individuals entrusted with making critical business decisions.

Directors’ and Officers’ Liability Insurance provides financial protection against covered legal defence costs, settlements and damages arising from claims made against Directors and officers acting in good faith. Equally important, Cyber Insurance has become an essential component of enterprise risk management, helping organisations respond to cyber incidents, business interruption and data breaches.

When combined with sound governance practices, these solutions enable boards to make informed decisions with greater confidence while strengthening organisational resilience.

Delmege: Proven leadership in insurance advisory

Delmege Insurance Brokers brings proven market leadership and specialist advisory expertise to this changing risk environment. According to industry statistics published by the Insurance Regulatory Commission of Sri Lanka, Delmege ranked No. 1 among Sri Lanka’s registered insurance broking companies by GWP for both 2023 and 2024, within a highly competitive market of more than 80 registered brokers.

This leadership reflects the confidence placed in Delmege by organisations across Sri Lanka. Through expert insurance advisory and tailored Directors’ and Officers’ Liability and Cyber Insurance solutions, Delmege helps boards identify protection gaps, strengthen resilience and protect both the organisation and the individuals entrusted with leading it.

COMMENTS