Personal Data Protection Act 2022 · As enacted · Part II · Rights of Data Subjects
17. Grant or refusal of rectification, completion, erasure or refrain from further processing
Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.
Official translationFrom Department of Government Printing, unchanged
Where a controller receives a written request from a data subject under sections 13, 14, 15 or 16, such controller shall inform the data subject in writing, within twenty-one working days from the date of such request, whether–
such request has been granted;
such request has been refused under subsection (2)
and the reasons thereof unless such disclosure is prohibited by any written law; or
the controller has refrained from further processing such personal data under sections 14(2) or 15 and reasons thereof, and inform the availability of the right of appeal to the data subject in respect of the decisions made by the controller under paragraphs (b) or (c).
The controller may, refuse to act on a request made under sections 13, 14, 15 or 16 of this Act, by a data subject having regard to–
the national security;
public order;
any inquiry conducted, investigation or procedure carried out under any written law;
the prevention, detection, investigation or prosecution of criminal offences;
the rights and freedoms of other persons under any written law;
subject to the provisions of subsection (4), the technical and operational feasibility of the controller to act on such request;
subject to the provisions of subsection (4), the inability of the controller to establish the identity of the data subject; or
the requirement to process personal data under any written law.
A controller shall, record the reasons for any refusal under subsection (2) and submit such records to the Authority upon a written request from the Authority.
Where a controller is unable to establish the identity of a data subject making a request under sections 13, 14, 15
or 16, such controller may, request the data subject to provide additional information to enable the controller to carry out such requests.
Any right conferred on a data subject under this Part may be exercised–
where the data subject is a minor, by parents or a person who has the parental authority over the minor or who has been appointed as his legal guardian; or
where the data subject is physically or mentally unfit, by a person who has been appointed as his guardian or administrator by a Court; or
by a person duly authorized in writing by the data subject to make a request under this Part except in the cases referred to in paragraphs (a) and (b); or
an heir to exercise a deceased data subject’s rights within a period of ten years from the date of demise of such data subject, in the manner prescribed by regulations.
A request made by a data subject under sections 13,
14, 15 or 16 may be accompanied by such fees, as may be prescribed by regulations made under this Act.
Where a fee is charged under subsection (6), the controller shall inform the data subject the details of such fees and reasons for imposing same.
Part III
Controllers and Processors
Part IV
Use of Personal Data to Disseminate Solicited Messages
Part V
Data Protection Authority
Part VI
Director-General and the Staff of the Authority
Part VII
Penalties
Part VIII
Fund of the Authority
Part IX
Miscellaneous
Part X