Sri Lanka defines trust boundaries ahead of digital ID rollout

Sri Lanka’s Unique Digital ID (SL-UDI project is placing trust architecture at the center of its rollout, with officials emphasizing the need to clearly define how data will be used and who can access it early in the process.

“The key takeaway from the Sri Lanka Unique Digital ID project highlights the critical importance of establishing trust boundaries from the outset,” Eng. Eranga Weeraratne, the Deputy Minister of Digital Economy, tells Biometric Update.

“This involves clearly defining what data will be collected, who will have access to it, the purposes for which it will be used, the oversight mechanisms in place, and the processes available for citizens to challenge any misuse of their data.”

A robust trust architecture is essential for fostering public confidence and encouraging adoption of the program. Conversely, if the trust framework is weak, even the most advanced technology will struggle to succeed. The foundational planning decision around trust is therefore critical to the long-term success of the initiative.

Hashed biometrics

Weeraratna said that to prevent misuse, biometric data such as fingerprints, iris, and facial recognition will be stored in hashed formats that cannot be reverse-engineered.

“There will be consent-based sharing where citizens will have control over their data, with real-time sharing allowed only through explicit consent mechanisms,” he added.

Noting that there are legal safeguards, he said the project is in line with the Personal Data Protection Act No. 9 of 2022 ensuring a clear legal framework for data retention and citizen redressal. The PDPA is South Asia’s first comprehensive data protection legislation designed to safeguard citizens’ data rights and foster digital economy growth.

Setting up the Data Protection Authority’s oversight is viewed as a critical prerequisite before scaling the program. Independent monitoring will be carried out by the Data Protection Authority, with Dimuth Bhashitha Atapattu appointed as Director General to lead these efforts as of March 2026.

SL-UDI is entering its final procurement and deployment phases, with the government targeting a launch in the third quarter of this year, Weeraratna added. The government previously told Biometric Update it is balancing ambition with realistic delivery timelines by taking a staged delivery approach with clear gates: readiness, pilot, controlled rollout, and scale.

Article Topics

biometric data  |  biometrics  |  data protection  |  data sharing  |  digital ID  |  SL-UDI  |  Sri Lanka