Act of Parliament · As enacted · 10 parts
Personal Data Protection Act 2022
Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.
Official translationFrom Department of Government Printing, unchanged
This Act may be cited as the Personal Data
Protection Act, No. 9 of 2022.
The provisions of this section, shall come into operation on the date on which the certificate of the Speaker is endorsed in respect of this Act in terms of Article 79 of the
Constitution.
All other provisions of this Act except the provisions of Part IV and Part V, shall come into operation on such date as the Minister may, appoint by Order published in the
Gazette, which shall be a date not earlier than eighteen months and not later than thirty six months from the date of the certificate of the Speaker referred to in subsection (2).
The date of operation of the provisions of Part IV of this Act, shall be a date not earlier than twenty-four months and not later than forty-eight months from the date of certificate referred to in subsection (2).
The date of operation of the provisions of Part V of this Act shall be a date appointed by the Minister by Order published in the Gazette which shall be a date not later than the date appointed by the Minister under subsection (3).
This Act shall apply to the processing of personal data—
where the processing of personal data takes place wholly or partly within Sri Lanka; or
where the processing of personal data is carried out by a controller or processor who–
is domiciled or ordinarily resident in
Sri Lanka;
is incorporated or established under any written law of Sri Lanka;
offers goods or services to data subjects in
Sri Lanka including the offering of goods or services with specific targeting of data subjects in Sri Lanka; or
specifically monitors the behaviour of data subjects in Sri Lanka including profiling with the intention of making decisions in relation to the behavior of such data subjects in so far as such behaviour takes place in Sri Lanka.
For the purposes of paragraphs (iii) and (iv) of subsection (1) respectively, the Authority may, determine by way of rules made under this Act–
the circumstances in which the specific targeting of the data subjects may occur; or
the circumstances in which the specific monitoring of the data subjects may occur.
This Act shall not apply to–
any personal data processed purely for personal, domestic or household purposes by an individual; and
any data other than personal data.
The provisions of this Act shall have effect notwithstanding anything to the contrary in any other written law, relating to the protection of personal data of data subjects:
Provided however, where a public authority is governed by any other written law, it shall be lawful for such authority to carry out processing of personal data in accordance with the provisions of such written law, in so far as the protection of personal data of data subjects is consistent with this Act.
In the event of any inconsistency between the provisions of this Act and the provisions of such written law, the provisions of this Act shall prevail.
Part I
Processing of Personal Data
Part II
Rights of Data Subjects
Part III
Controllers and Processors
Part IV
Use of Personal Data to Disseminate Solicited Messages
Part V
Data Protection Authority
Part VI
Director-General and the Staff of the Authority
Part VII
Penalties
Part VIII
Fund of the Authority
Part IX
Miscellaneous
Part X