ADB urges cybersecurity, data protection must be core of SL’s digital economy

• ADB Sectors Department 2 Director General Cleo Kawawaki calls cybersecurity a “whole-of-society” responsibility
• Warns that cyber risks can undermine digital progress and public trust
• Chief Presidential Adviser on Digital Economy and ICTA Chairman Dr. Hans Wijayasuriya assures cybersecurity, privacy and AI are foundation of growth

The Asian Development Bank (ADB) yesterday urged Sri Lanka to treat cybersecurity and data protection as central pillars of its digital transformation agenda, warning that national competitiveness and public trust in digital services will depend on how well the country safeguards its information infrastructure.

ADB Sectors Department 2 Director General Cleo Kawawaki said cybersecurity is not only a policy or institutional concern but a shared responsibility that must extend across government, business, and individuals. 

“This morning, I woke up with a phishing email telling me that my app had been accessed from somewhere else and that I should press a button to fix it,” she said at the ADB Serendipity Knowledge Program (SKOP) on Digital Transformation: Cybersecurity and Data Protection for Digital Economy Development yesterday in Colombo, in partnership with the Department of National Planning of the Finance Ministry. 

“We all know what that means. It means that if I press that, it steals all my details. Cybersecurity threatens every single one of us. All of the promises of the digital economy can be undone by one person not watching out and pressing that button,” she added.

She said that while technology and policy are critical, awareness and behaviour across society are equally vital to building a resilient digital economy. 

“It is not just a policy issue, it is not just an institutional issue, but a whole-of-society issue,” she said. “Events like this can raise awareness and help us find solutions so that the promise of digital can be delivered to the whole society without the crushing risks and breaches of trust that come from these threats.”

Kawawaki said the ADB’s SKOP is a flagship initiative supporting Sri Lanka’s evolving development priorities and advancing secure, inclusive, and interoperable digital ecosystems across the Asia-Pacific region. 

“The Government has recently launched its cybersecurity strategy and is reinforcing its institutional foundations through the implementation of the Data Protection Act and the forthcoming Cyber Security Bill,” she said. 

“As Sri Lanka accelerates its digital transformation, enabling whole-of-Government digitalisation and expanding services to citizens, the need for a secure and trusted digital economy has become more relevant than ever.”

She warned that cyber threats and data privacy risks are growing in scale and complexity, posing significant challenges to public trust, economic resilience, and national security. 

“Without trust, digital services cannot thrive. Without security, the benefits of digitalisation risk being undermined,” she said. “That is why cybersecurity and data protection must be embedded by design and by default into all of the country’s digital initiatives.”

Kawawaki said the ADB is working with the Government to strengthen the country’s cybersecurity and data protection governance frameworks and build institutional capacity to respond effectively to emerging threats. 

Chief Adviser to the President on Digital Economy and Information Communication Technology Agency of Sri Lanka (ICTA) Chairman Dr. Hans Wijayasuriya told the forum that Sri Lanka will anchor its digital economy strategy on cybersecurity and data protection, viewing them not as regulatory necessities but as the foundation for innovation, competitiveness, and economic resilience.

Dr. Wijayasuriya said secure data systems and privacy frameworks will define Sri Lanka’s ability to build trust and attract investment in the digital era.

“A good data protection and cybersecurity framework provides the platform for innovation and competitive advantage. Few countries can now compete on cost; agility and trust are the new calling cards,” he said.

He explained that cybersecurity and privacy measures form the “security by design” foundation for the Government’s plan to grow the digital economy fivefold to $ 15 billion by 2029 and triple digital exports to more than $ 5 billion.

“We designed the Digital Economy Blueprint for Sri Lanka to be Artificial Intelligence (AI)-first and anchored on trust. Cybersecurity, privacy, and ethical AI are not optional—they are the bedrock of growth,” he added.

Dr. Wijayasuriya noted that Sri Lanka has already made significant progress with the enactment of the Personal Data Protection Act (PDPA), the establishment of the Data Protection Authority, and the development of the National Cyber Security Centre (NSSERT). These, he said, place Sri Lanka in the upper quartile globally in terms of cyber resilience.

He urged policymakers and businesses to treat trust and data governance as strategic differentiators.

“In today’s digital economy, our unique competitive advantage must be trust, delivered through world-class cybersecurity, privacy technologies, and governance,” he said, adding, “Sri Lanka should aim to be known as the Serendip of trust, governance, and safety in the digital world.”

Industry leaders and Government officials yesterday emphasised the urgent need to build a security-first and privacy-respecting culture across Sri Lanka’s digital ecosystem, highlighting enforcement challenges, data protection gaps, and the importance of public-private partnerships at the SKOP on Digital Transformation: Cybersecurity and Data Protection for Digital Economy Development hosted by the ADB in Colombo.

During the first panel discussion, moderated by ADB Digital Technology Specialist – Cybersecurity and Data Privacy Masatake Yamamichi, participants examined the role of cybersecurity and data protection in developing Sri Lanka’s digital economy, enforcement challenges, and international cooperation. Speakers included Japanese Internal Affairs and Communications Ministry Office of the Director-General for Cybersecurity Director Yuki Naruse, Sri Lanka Computer Emergency Readiness Team (SLCERT) Chairman Thilak Pathirage, Commercial Bank of Ceylon PLC Chief Information Security Officer Sunari Dandeniya, Sysco LABS Security Architect Lasantha Priyankara, and Scybers Head of Threat Intelligence Chamath Rathnasekara.

The panellists discussed the need for greater capacity building and consistent enforcement of cybersecurity policies, while stressing that rapid digitalisation across sectors has made resilience and data protection essential to economic stability. The discussion also covered emerging cyber threats, the balance between privacy and innovation, and strengthening institutional frameworks through international collaboration.

A second panel, moderated by ADB Digital Sector Director Antonio Zaballos, focused on cultivating a “security-first and privacy-by-design” mindset from schools to workplaces, including within Government institutions. Speakers included LIRNEasia Founder and Sarvodaya Chairman Prof. Rohan Samarajiva, Data Protection Authority Chairman Rajeeva Bandaranaike, and Visa Sri Lanka and Maldives Country Manager Avanthi Colombage.

The discussion underscored the importance of building trust in digital services, enhancing regulatory enforcement, and improving digital literacy across both public and private sectors. Bandaranaike highlighted that regulation must evolve alongside awareness, while Prof. Samarajiva called for consistent public policy frameworks to prevent data misuse. Colombage noted that private-sector collaboration can help improve public confidence in digital transactions and strengthen cybersecurity infrastructure.