Cybercrime costs Sri Lanka up to $ 1 b a year, ADB estimates

Thursday, 16 October 2025 06:07 - - {{hitsCtrl.values.hits}}

Data Protection Authority Chair Rajeeva Bandaranaike says challenge lies in fostering culture of data privacy and cybersecurity
Upcoming data and cybersecurity legislations would lay the groundwork for better governance

ADB Digital Sector Office Director Antonio Zaballos

Data Protection Authority Chairman Rajeeva Bandaranaike

The annual cost of cybercrime to Sri Lanka could range between $ 450 million and $ 1 billion, Asian Development Bank (ADB) Digital Sector Office Director Antonio Zaballos said yesterday, calling for stronger cybersecurity measures and a shift in national awareness as the country expands its digital economy.

Speaking at the ADB’s Serendipity Knowledge Program (SKOP) on Digital Transformation: Cybersecurity and Data Protection for Digital Economy Development held in Colombo, Zaballos said global losses from cybercrime have reached $ 10.5 trillion, or nearly 9% of the world’s GDP.

“If we were just doing a rough estimate, and we consider just between 0.5-1% of the total GDP of Sri Lanka, we would be talking around $ 450 million to $ 1 billion a year related to cybercrime,” he said.

He cautioned that as economies become increasingly connected, they also become more vulnerable. “The more connected we are, the more at risk we are,” Zaballos said, describing cybersecurity as both a development and technical challenge that must be addressed through cooperation between governments, the private sector, and citizens.

Data Protection Authority Chairman Rajeeva Bandaranaike said Sri Lanka’s challenge lies not only in technology but in fostering a culture of data privacy and cybersecurity.

“We don’t have a culture of data privacy and data protection, and awareness levels are very low,” he said. “It’s about policymakers taking ownership and embedding a sense of responsibility across society.”

Bandaranaike said Sri Lanka’s forthcoming Data Protection Act and cybersecurity legislation would lay the groundwork for better governance, but long-term awareness building was equally important. “Like helmets and seatbelts, data protection will eventually become second nature, but it requires consistent enforcement and education,” he said.