Cyber Law Reform for Human-Centred Governance in Sri Lanka

Cybercrime has become a major governance challenge, threatening public trust, human rights, and national security. Sri Lanka’s Computer Crimes Act (2007) and related legislation have not kept pace with emerging risks such as ransomware, AI-driven fraud, and crypto-enabled offences. This study examines the adequacy of Sri Lanka’s cybercrime framework in addressing contemporary threats and aligning with global rights-based standards. Using a hybrid qualitative methodology combining doctrinal legal analysis and expert interviews with judges, policymakers, and cybersecurity professionals, the research identifies three core deficiencies: outdated legal definitions, weak rights safeguards, and fragmented institutional coordination. Drawing on international benchmarks such as the Budapest Convention, GDPR, and NIS2 Directive, the paper proposes a four-layered reform framework founded on human rights, institutional capacity-building, international harmonisation, and adaptive governance. The proposed reforms aim to guide policymakers towards a modern, transparent, and citizen-centred cyber law regime that enhances digital resilience and democratic legitimacy in Sri Lanka and offers a transferable model for other developing jurisdictions.