Skip to content
srilawsby aturio
As enacted
Contents

Part III · Controllers and Processors

23. Personal Data breach notifications

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

(1)

In the event of a personal data breach, a controller shall notify the Authority, regarding such personal data breach in such form, manner and within such period of time as may be determined by rules made under this Act.

(2)

The Authority shall provide for–

(a)

the circumstances where the Authority shall be notified of such data breach;

(b)

the circumstances where the affected data subject shall be notified; and

(c)

the form, and manner of making such notification, and information which shall be provided in such notification relating to the data breach, by way of rules made under this Act.

Read on from s 24

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X

Schedules