PDPA Compliance Challenges in Sri Lankan Cloud-Based Health Information Systems: A Qualitative Comparative Case Analysis of HHIMS, DHIS2, and Documentary Evidence
DOI:
https://doi.org/10.31098/jgrcs.v6i2.4464Keywords:
Personal Data Protection Act (PDPA), Cloud-Based Health Information Systems, Healthcare Data Governance, Data Localisation, Health Data Protection, Cross-Border Data Transfer, Digital Health GovernanceAbstract
In recent years, the country's digitisation efforts in health information systems have increased significantly, with the use of cloud-based systems integrated into both public and private health care networks. To meet the complex requirements of personal data protection, Sri Lanka's healthcare organisations dealing with sensitive patient data on cloud infrastructure must effectively navigate the new legal landscape established by the PDPA, which was enacted in 2022 and positions the country as the first in South Asia with holistic data protection laws. This paper conducts a case study that explores compliance issues of Cloud based Health Information Systems (HIS) in the context of PDPA in Sri Lanka. This study, based on a qualitative analysis of the provisions of the PDPA, a review of existing digital health deployments such as the Hospital Health Information Management System (HHIMS) and the District Health Information System (DHIS2) and a comparative analysis of international digital health protection frameworks like GDPR, HIPAA and ISO/IEC 27001, identifies six main compliance challenge domains: data localisation and cross-border transfer restrictions, consent management complexity, data protection officer (DPO) capacity gaps, cloud vendor accountability, breach notification readiness, and the ambiguity of PDPA's phased implementation. The paper then presents a proposed PDPA-Aligned Cloud Health Compliance Framework (PACHCF) to offer structured pathways for healthcare organisations. This study is an original and domain-specific compliance model in digital health governance that can be contextualized into Sri Lanka and South Asia.
Keywords Personal Data Protection Act (PDPA); Cloud-based health information systems; Healthcare data governance; Regulatory compliance; Data localisation; Sri Lanka
References
Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A., Stoica, I., & Zaharia, M. (2010). A view of cloud computing. Communications of the ACM, 53(4), 50–58. https://doi.org/10.1145/1721654.1721672
Braun, V., & Clarke, V. (2006). Using thematic analysis in psychology. Qualitative Research in Psychology, 3(2), 77–101. https://doi.org/10.1191/1478088706qp063oa
Censinet. (2025a). ISO 27001 vs HIPAA: Compliance in healthcare. https://censinet.com/perspectives/iso-27001-vs-hipaa-compliance-healthcare
Censinet. (2025b, December 24). How ISO 27001 secures patient data. https://censinet.com/perspectives/how-iso-27001-secures-patient-data
Censinet. (2025c). GDPR vs. HIPAA: Cross-border breach rules. https://censinet.com/perspectives/gdpr-vs-hipaa-cross-border-breach-rules
Chatzou Dunford, M. (2026, April 30). Healthcare data sovereignty compliance: What it means and why it matters for your organization. Lifebit. https://lifebit.ai/blog/healthcare-data-sovereignty-compliance/
ComplianceHub. (2025). GDPR 2025 updates: Navigating cross-border transfers and stricter breach reporting. https://compliancehub.wiki/gdpr-2025-updates-navigating-cross-border-transfers-and-stricter-breach-reporting/
Conduah, A. K., Ofoe, S., & Siaw-Marfo, D. (2025). Data privacy in healthcare: Global challenges and solutions. Digital Health. https://doi.org/10.1177/20552076251343959
Creswell, J. W., & Creswell, J. D. (2018). Research design: Qualitative, quantitative, and mixed methods approaches (5th ed.). SAGE Publications.
Data Protection Authority of Sri Lanka. (2023). About the PDPA. https://www.dpa.gov.lk/
DLA Piper. (2025). Data protection laws of the world: Sri Lanka. https://www.dlapiperdataprotection.com/index.html?t=law&c=LK
DPO Consulting. (2025, December 5). Cross-border data transfers: A global guide to compliance. https://www.dpo-consulting.com/blog/cross-border-data-transfers
European Parliament and Council. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union.
Exemplars in Global Health. (2021). DHIS2 in Sri Lanka. https://www.exemplars.health/emerging-topics/epidemic-preparedness-and-response/digital-health-tools/sri-lanka
GDPR Local. (2025). Digital sovereignty: Data control and compliance in a digital world. https://gdprlocal.com/digital-sovereignty/
Health Information Systems Programme (HISP) Sri Lanka. (2023). Digital health capacity building. Postgraduate Institute of Medicine, University of Colombo.
Information and Communication Technology Agency of Sri Lanka. (2022). Hospital health information management system (HHIMS). https://www.icta.lk/projects/digital-government/hospital-health-information-management-system-hhims
Information and Communication Technology Agency of Sri Lanka. (2021). Outcome assessment of the Digital Health Project: Hospital Health Information Management System (HHIMS) final report. https://www.icta.lk/icta-assets/uploads/2023/02/Digital-Health-Project-HHIMS-Final-Report-V-1-13th-July-2021-1.pdf
ISACA. (2024). Cloud data sovereignty, governance and risk implications of cross-border cloud storage. ISACA Industry News. https://www.isaca.org/resources/news-and-trends/industry-news/2024/cloud-data-sovereignty-governance-and-risk-implications-of-cross-border-cloud-storage
Jayathissa, P., & Hewapathrana, R. (2023). HAPI-FHIR server implementation to enhancing interoperability among primary care health information systems in Sri Lanka: Review of the technical use case. European Modern Studies Journal, 7(6), 23. https://doi.org/10.59573/emsj.7(6).2023.23
Kinkade, C., Russpatrick, S., Potter, R., Saebo, J., Sloan, M., Odongo, G., Singh, T., & Gallagher, K. (2022). Extending and strengthening routine DHIS2 surveillance systems for COVID-19 responses in Sierra Leone, Sri Lanka, and Uganda. Emerging Infectious Diseases, 28(13), Article 22-0711. https://doi.org/10.3201/eid2813.220711
Kiteworks. (2026). Healthcare data sovereignty: Requirements for transferring patient data across borders. https://www.kiteworks.com/hipaa-compliance/healthcare-data-sovereignty-cross-border-transfer/
Ministry of Health, Nutrition and Indigenous Medicine Sri Lanka. (2023). Digital health blueprint. OpenHIE. https://ohie.org/wp-content/uploads/2024/04/DigitalHealthBluePrint_SRILANKA-2.pdf
Mutale, W., Chintu, N., Amoroso, C., Awoonor-Williams, K., Phillips, J., Jackson, E., Taylor, A., Schwarz, R., Faye Iarrobino, M., & Sherr, K. (2013). Improving health information systems for decision making across five sub-Saharan African countries: Implementation strategies from the African Health Initiative. BMC Health Services Research, 13(S2), S9. https://doi.org/10.1186/1472-6963-13-S2-S9
Nithya Partners. (2022). Data protection legislation in Sri Lanka. https://www.nithyapartners.com/journal/data-protection-legislation-in-sri-lanka
Numair, T., Harrell, D. T., Huy, N. T., Nishimoto, F., Muthiani, Y., Nzou, S. M., Lasaphonh, A., Palama, K., Pongvongsa, T., Moji, K., Hirayama, K., & Kaneko, S. (2021). Barriers to the digitization of health information: A qualitative and quantitative study in Kenya and Lao PDR using a cloud-based maternal and child registration system. International Journal of Environmental Research and Public Health, 18(12), 6196. https://doi.org/10.3390/ijerph18126196
OneTrust. (2024). HIPAA vs. ISO 27001: What's the difference? https://www.onetrust.com/blog/hipaa-vs-iso-27001-whats-the-difference/
Parliament of Sri Lanka. (2022). Personal Data Protection Act, No. 9 of 2022 (Sections 5–43). Government of Sri Lanka. https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf
Parliament of the Democratic Socialist Republic of Sri Lanka. (2025). Personal Data Protection (Amendment) Act, No. 22 of 2025. https://www.parliament.lk/uploads/acts/gbills/english/6384.pdf
Rodrigues, J. J. P. C., De La Torre, I., Fernández, G., & López-Coronado, M. (2013). Analysis of the security and privacy requirements of cloud-based electronic health records systems. Journal of Medical Internet Research, 15(8), e186. https://doi.org/10.2196/jmir.2494
Scytale. (2025). HIPAA vs. ISO 27001: What's the difference? https://scytale.ai/resources/hipaa-vs-iso-27001/
WilmerHale. (2022, March 30). Sri Lanka becomes the first South Asian country to pass comprehensive privacy legislation. https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20220330-sri-lanka-becomes-the-first-south-asian-country-to-pass-comprehensive-privacy-legislation
World Health Organization. (2021). Digital health. https://www.who.int/health-topics/digital-health
Yin, R. K. (2018). Case study research and applications: Design and methods (6th ed.). SAGE Publications.
Downloads
Published
Citation Check
How to Cite
Issue
Section
License
Copyright (c) 2026 Y P Viduruwan, M G P Jeewantha, M A P Nimsara, A M K V Abhayasundara, K M Piyumal
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Content Licensing, Copyright, and Permissions
1. License
Journal of Governance Risk Management Compliance and Sustainability (JGRCS) has CC-BY NC or an equivalent license as the optimal license for the publication, distribution, use, and reuse of scholarly work for non-commercial purpose. The non-commercial use of the article will be governed by the Creative Commons Attribution license as currently displayed on Creative Commons Attribution-NonCommercial 4.0 International License
Creative Commons License
2. Author’s Warranties
The author warrants that the article is original, written by stated author(s), has not been published before, contains no unlawful statements, does not infringe the rights of others, is subject to copyright that is vested exclusively in the author and free of any third party rights, and that any necessary written permissions to quote from other sources have been obtained by the author(s).
3. User Rights
Journal of Governance Risk Management Compliance and Sustainability (JGRCS) objective is to disseminate articles published are as free as possible. Under the Creative Commons license, this journal permits users to copy, distribute, display, and perform the work for non-commercial purposes only. Users will also need to attribute authors and this journal on distributing works in the journal.
4. Rights of Authors
Authors retain the following rights:
Copyright, and proprietary rights relating to the article, such as patent rights,
The right to use the substance of the article in future own works, including lectures and books, The right to reproduce the article for own purposes, The right to self-archive the article, the right to enter into separate, additional contractual arrangements for the non-exclusive distribution of the article's published version (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal (Journal of Governance Risk Management Compliance and Sustainability).
The author has a non-exclusive publishing contract with a publisher and the work is published with a more restrictive license, the author retains all the rights to publish the work elsewhere, including commercially, because she/he is not subject to the conditions of her / his own license, regardless of the type of CC license chosen.
5. Co-Authorship
If the article was jointly prepared by other authors, the signatory of this form warrants that he/she has been authorized by all co-authors to sign this agreement on their behalf, and agrees to inform his/her co-authors of the terms of this agreement.
6. Termination
This agreement can be terminated by the author or Journal of Governance Risk Management Compliance and Sustainability (JGRCS) upon two months’ notice where the other party has materially breached this agreement and failed to remedy such breach within a month of being given the terminating party’s notice requesting such breach to be remedied. No breach or violation of this agreement will cause this agreement or any license granted in it to terminate automatically or affect the definition of Journal of Governance Risk Management Compliance and Sustainability (JGRCS).
7. Royalties
This agreement entitles the author to no royalties or other fees. To such extent as legally permissible, the author waives his or her right to collect royalties relative to the article in respect of any use of the article by This agreement can be terminated by the author or Journal of Governance Risk Management Compliance and Sustainability (JGRCS) upon two months’ notice where the other party has materially breached this agreement and failed to remedy such breach within a month of being given the terminating party’s notice requesting such breach to be remedied. No breach or violation of this agreement will cause this agreement or any license granted in it to terminate automatically or affect the definition of Journal of Governance Risk Management Compliance and Sustainability (JGRCS) or its sublicensee.
8. Miscellaneous
Journal of Governance Risk Management Compliance and Sustainability (JGRCS) will publish the article (or have it published) in the journal if the article’s editorial process is successfully completed and Journal of Governance Risk Management Compliance and Sustainability or its sublicensee has become obligated to have the article published. Journal of Governance Risk Management Compliance and Sustainability may conform the article to a style of punctuation, spelling, capitalization, referencing and usage that it deems appropriate. The author acknowledges that the article may be published so that it will be publicly accessible and such access will be free of charge for the readers
