Personal Data Protection Act 2022 · As enacted
2. Application of this Act
Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.
Official translationFrom Department of Government Printing, unchanged
This Act shall apply to the processing of personal data—
where the processing of personal data takes place wholly or partly within Sri Lanka; or
where the processing of personal data is carried out by a controller or processor who–
is domiciled or ordinarily resident in
Sri Lanka;
is incorporated or established under any written law of Sri Lanka;
offers goods or services to data subjects in
Sri Lanka including the offering of goods or services with specific targeting of data subjects in Sri Lanka; or
specifically monitors the behaviour of data subjects in Sri Lanka including profiling with the intention of making decisions in relation to the behavior of such data subjects in so far as such behaviour takes place in Sri Lanka.
For the purposes of paragraphs (iii) and (iv) of subsection (1) respectively, the Authority may, determine by way of rules made under this Act–
the circumstances in which the specific targeting of the data subjects may occur; or
the circumstances in which the specific monitoring of the data subjects may occur.
This Act shall not apply to–
any personal data processed purely for personal, domestic or household purposes by an individual; and
any data other than personal data.
Part I
Processing of Personal Data
Part II
Rights of Data Subjects
Part III
Controllers and Processors
Part IV
Use of Personal Data to Disseminate Solicited Messages
Part V
Data Protection Authority
Part VI
Director-General and the Staff of the Authority
Part VII
Penalties
Part VIII
Fund of the Authority
Part IX
Miscellaneous
Part X