Sovereign Symposium 2026 explores Sri Lanka’s digital public infrastructure

By Safna Malik 

The Sovereign Cloud Symposium 2026, co-hosted by Amazon Web Services and NCINGA, brought together industry and public sector leaders last week to explore how sovereign cloud and digital public infrastructure can support large scale delivery of government and enterprise digital services. The discussion focused on how cross sector cooperation can move from vision to implementation, and how the impact of these systems can be measured as digital services continue to expand.

Panel featured AWS Centre for Digital Public Infrastructure Principal Product Manager and Digital Public Infrastructure Lead Pete Herlihy; AWS Principal Solutions Architect and MAS Holdings Chief Digital Officer Steve Dodd; SLT Mobitel General Manager - Digital Transformation Projects Eng. Ishari Suranja Siriwardane; and ICTA Sri Lanka Digital Law Specialist and Data Protection Act Drafting Committee Chairman Jayantha Fernando.

Opening the session on digital governance terminology, Herlihy outlined how emerging frameworks such as digital public infrastructure (DPI) and digital public goods (DPGs) are reshaping national digital ecosystems. He set the context by breaking down how shared digital systems are increasingly forming the backbone of government and wider ecosystem services.

Defining digital public infrastructure and digital public goods

Herlihy described DPI as foundational horizontal digital layers that enable core public and private sector interactions, including identity verification, payments, data exchange, and messaging systems. He noted that while these functions may appear basic, their systemic reuse across sectors significantly improves efficiency and trust.

“These are horizontal digital capabilities used across government and the wider digital ecosystem.” He further explained that digital public goods refer to open-source, freely accessible building blocks that can be deployed to deliver these DPI functions at scale, enabling countries to adopt proven systems more rapidly rather than developing them from scratch.

On the broader question of digital sovereignty, Herlihy highlighted commonly accepted principles including data residency control, verifiable access restrictions, always-on encryption with customer-held keys, system resilience, and the need to build local technical capacity alongside infrastructure deployment. 

Herlihy added that Sri Lanka is in a stronger position compared to countries that pioneered these systems from scratch, because many of the core building blocks now already exist as open source digital public goods. “This means other countries can now adopt and adapt them in months, sometimes even weeks. It is a real step change, because what once took a decade can now take about a year.”

Balancing data sovereignty and delivery speed

Dodd noted that the technology is already in place and the capacity for speed exists, but said the challenge lies in how discussions frequently begin and end with data. He observed that not all information needs the same level of control, and that treating every issue as a data sovereignty problem can create unnecessary limits on what can be delivered.

Adding to this, Dodd said, “In China, regulations are extremely strict, to the point where access to underlying personal data can be highly restricted. Once sovereignty is applied too broadly, everything ends up needing to stay local, which means you need the resources to support that. The technology exists to do this, but if you do not take a pragmatic approach and decide what genuinely needs protecting, it can slow down everything else you are trying to deliver.”

Building federated model for data sharing 

"What we have in Sri Lanka is institutional silos and a psychological barrier around data-sharing," Siriwardane said, highlighting that proper policy and legislation form the foundation for progress. "A federated data-exchange model gives departments the technical tooling to share data without losing control or giving up ownership."

Siriwardane noted that successful implementation requires a combination of improved departmental data literacy and a consent-centric framework, which would allow the public to authorise data reuse rather than repeatedly submitting identical documents across multiple government touchpoints. Pointing to an international reference point where a national data exchange serves over 1,000 institutions and 50,000 services, she added that overcoming these interoperability challenges is entirely achievable and delivers significant efficiency savings.

Cloud-friendly data frameworks

"The level of obligation really depends on the nature and sensitivity of the processing activity," Fernando said, noting that regulatory safeguards naturally increase alongside data sensitivity. 

Under this updated framework, data controllers have a flexible choice of cross-border transfer mechanisms, provided that core processing principles are respected. Fernando stated that published guidance now offers a clear menu of options including standard contractual clauses similar to the EU model, cross-border transfer rules, and certification-based mechanisms allowing mapping against an upcoming national data classification framework. He highlighted the importance of sector regulators, such as the central bank, aligning their specific rules with this gateway framework to eliminate existing inconsistencies in how the processing of personal data is defined.

Financing sustainable digital infrastructure

"Funding itself isn't really the bottleneck; the real question is how we invest strategically and what kinds of models we back," Siriwardane said, stressing that the state must establish a unified investment blueprint up front. "Without that, you get individual, siloed projects, everyone investing independently which leads to duplication and means the bigger goal never gets achieved."

Siriwardane argued for a fundamental shift from a rigid project mindset to a scalable platform mindset, citing India's creation of an entire digital economy on shared infrastructure as a premier model for development. While noting that commercial self-sustainability requires a mix of capital, including consumption-based models where users pay for what they use, she emphasised that simply purchasing technology is insufficient. To scale these systems exponentially without creating fresh public sector dependencies, she pointed out that the state must simultaneously invest in human capital, building local expertise alongside experienced international partners who have successfully navigated these transitions before.

Expanding on this consumption-based approach, Herlihy added that international models successfully offset public expenditure through targeted private-sector utilisation. He pointed to Brazil's digital identity platform, which was developed by the state but relies heavily on private banks and infrastructure providers who pay a small verification fee that, in aggregate, funds a meaningful share of ongoing operational costs. Noting that the UK has deployed a similar mechanism to keep services free or low-cost for citizens, ‘’that there is no singular correct path, but rather a need to find the right equilibrium between public funding and private-sector consumption fees tailored to the local framework.’’

Transforming public infrastructure through digital talent

"The public sector is genuinely a more complex environment to work in," Dodd said, noting that extensive legacy platform investment means much institutional knowledge sits with people later in their careers who are not necessarily looking to adopt new systems. "So this is not purely a technology transformation, it is partly a generational one."

Dodd explained that modern university graduates are already cloud native and full stack developers who find it easier to rebuild systems properly in the cloud rather than continue patching outdated infrastructure. The real challenge is creating a compelling enough narrative to attract and retain the exceptional talent emerging from local universities. He noted that because many local employers still rely on older, on premise software frameworks, a large portion of this workforce goes overseas for better opportunities. 

He added that the strategy must focus on keeping young professionals excited about modern technology to retain them locally, while actively retraining the experienced workforce who wish to remain involved and contribute genuine value to both public and private sector delivery.

Driving public digital adoption

"Digital public infrastructure as a concept is great, but it is worth remembering most people do not think of it as a product," Herlihy said, noting that while the industry has helped many countries build systems, far fewer have rolled them out to high adoption across government, the private sector, and citizens. "The gap between countries that succeed and those that do not is striking. I have seen cases where the technical implementation was excellent and smooth, yet adoption never followed because there was no real excitement around the use case, or the groundwork had not been done to prepare people for it."

Herlihy explained that what works much better is making the solution itself cheaper, faster, and genuinely better than the alternative so that not using it starts to feel negligent, which also pushes private sector providers built on top of it to compete and raise the bar further. To achieve this, he suggested borrowing from the best SaaS companies' go to market playbook by replacing long, heavy onboarding workshops with a frictionless approach that delivers value almost immediately. By offering a generous free tier so people experience the value before being asked to commit, he mentioned that the underlying quality of the infrastructure itself, is the single biggest factor in whether digital public infrastructure achieves real adoption at a societal scale.

The discussion closed on a shared note: Sri Lanka now has the foundations in place for sovereign cloud adoption, and the work ahead lies in turning those foundations into action. 

- Pic by Shehan Gunasekara