As enacted

Contents

1. Short Title and date of operation

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

(1)

This Act may be cited as the Personal Data

Protection Act, No. 9 of 2022.

(2)

The provisions of this section, shall come into operation on the date on which the certificate of the Speaker is endorsed in respect of this Act in terms of Article 79 of the

Constitution.

(3)

All other provisions of this Act except the provisions of Part IV and Part V, shall come into operation on such date as the Minister may, appoint by Order published in the

Gazette, which shall be a date not earlier than eighteen months and not later than thirty six months from the date of the certificate of the Speaker referred to in subsection (2).

(4)

The date of operation of the provisions of Part IV of this Act, shall be a date not earlier than twenty-four months and not later than forty-eight months from the date of certificate referred to in subsection (2).

(5)

The date of operation of the provisions of Part V of this Act shall be a date appointed by the Minister by Order published in the Gazette which shall be a date not later than the date appointed by the Minister under subsection (3).

Read on from s 2

Part I

Processing of Personal Data

Read on from Part I

Part II

Rights of Data Subjects

Read on from Part II

Part III

Controllers and Processors

Read on from Part III

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X