Act 2022
Personal Data Protection Act, No. 9 of 2022
Issued by Data Protection Authority of Sri Lanka
Plain-English summary
Sri Lanka's data protection law, certified on 19 March 2022. It sets lawful processing grounds (s. 5), data subject rights of access, rectification, erasure and withdrawal of consent (ss. 13-16), a data protection officer duty (s. 20) and breach notification to the Authority within a period set by rules (s. 23). The Authority's website also lists the Personal Data Protection (Amendment) Act, No. 22 of 2025, which the PDF linked here does not contain.
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, notice and data subject rights | Ongoing | DPA | official | |
Processing is lawful only where the controller meets the conditions in the Schedules (s. 5). Controllers must give data subjects the Schedule V information in a concise, transparent form at collection (s. 11). Data subjects may access their data (s. 13), withdraw consent (s. 14), and request rectification (s. 15) and erasure (s. 16). |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.