Skip to content
As enacted
Contents

2. Application of this Act

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

(1)

This Act shall apply to the processing of personal data—

(a)

where the processing of personal data takes place wholly or partly within Sri Lanka; or

(b)

where the processing of personal data is carried out by a controller or processor who–

(i)

is domiciled or ordinarily resident in

Sri Lanka;

(ii)

is incorporated or established under any written law of Sri Lanka;

(iii)

offers goods or services to data subjects in

Sri Lanka including the offering of goods or services with specific targeting of data subjects in Sri Lanka; or

(iv)

specifically monitors the behaviour of data subjects in Sri Lanka including profiling with the intention of making decisions in relation to the behavior of such data subjects in so far as such behaviour takes place in Sri Lanka.

(2)

For the purposes of paragraphs (iii) and (iv) of subsection (1) respectively, the Authority may, determine by way of rules made under this Act–

(a)

the circumstances in which the specific targeting of the data subjects may occur; or

(b)

the circumstances in which the specific monitoring of the data subjects may occur.

(3)

This Act shall not apply to–

(a)

any personal data processed purely for personal, domestic or household purposes by an individual; and

(b)

any data other than personal data.

Part I

Processing of Personal Data

Part II

Rights of Data Subjects

Part III

Controllers and Processors

Part IV

Use of Personal Data to Disseminate Solicited Messages

Part V

Data Protection Authority

Part VI

Director-General and the Staff of the Authority

Part VII

Penalties

Part VIII

Fund of the Authority

Part IX

Miscellaneous

Part X

Interpretation

Schedules