🇱🇰Personal Data Protection Act No. 9 of 2022, as amended
Personal Data Protection Act No. 9 of 2022, as amended
The Act regulates controllers and processors in Sri Lanka and certain processing outside Sri Lanka. Act No. 22 of 2025 changed commencement, rights-response timing, DPO and DPIA provisions, and replaced the cross-border section.
Core duties commencing 1 January 2027
Principles and grounds: Sections 5-11 and Schedules I-IV cover lawful grounds, consent, purpose limitation, minimisation, accuracy, retention and integrity and confidentiality.
Rights: Sections 13-18 cover access, withdrawal, objection, correction, erasure and review of solely automated decisions. Amended section 17 requires a response without undue delay and within one month, extendable by up to two further months with timely notice.
DPOs and processors: Amended section 20 sets public-body, monitoring, special-category and risk-based DPO triggers. Sections 21-22 require suitable processors, written terms, instructions, confidentiality, audit support, deletion or return and sub-processor accountability.
Incidents and DPIAs: Section 23 requires notifications in the form, manner and period set by rules. Section 24 requires an assessment before listed high-risk processing; the 2025 amendment makes submission to the Authority request-based rather than automatic.
Transfers: Amended section 26 requires continued compliance and Authority-specified binding instruments, or a listed exception such as explicit informed consent, contract necessity, legal claims or public interest.
The Act leaves breach-notification timing to rules. Draft breach rules published for consultation are not treated here as final law, so the controls require rule-based timing rather than asserting 72 hours.