Five years ago, the only significant data privacy laws in South Asia (or SAARC, the South Asia Area of Regional Cooperation) were India’s new and extremely limited private sector law, and Nepal’s public sector law. The region’s data privacy protections were far more limited than in North-east Asia or the ASEAN countries.(1) India continues to prevaricate, but is expected to introduce a modernising Bill in the 2019 winter Congress sessions. Meanwhile, in addition to the Sri Lankan Bill which is the focus of this article, Bhutan and Nepal have enacted privacy laws, and Pakistan has a private sector Bill. Bangladesh, Afghanistan and the Maldives continue to be the states in the SAARC region where there are no significant developments.