32. Powers of the Authority

The Authority may exercise the following powers, for the purpose of performing duties and discharging functions under this Act:–

to carry out whether directly or through any officer, agent, entity or institutions authorized in that behalf by the Authority, all such matters as may be necessary for the implementation of the provisions of this Act;

to take all such steps to ensure that controllers and processors carry out their duties and obligations in accordance with the provisions of this Act and inspect any information held by a controller or a processor in order to ensure the performance of his duties and obligations;

to direct a controller or a processor to take steps to comply with the provisions of this Act, including the requirement to publish terms and conditions subject to which and the manner in which processing activities are carried out;

to direct a controller or any relevant data protection officer to reimburse fees charged from a data subject for failure to provide the required information in a timely manner;

to conduct inquiries, receive complaints, require any person to appear before it, make directives and impose fines in accordance with the provisions of this Act;

to examine a person under oath or affirmation and require such person where necessary to produce any information relating to the processing of functions of a controller or processor in the manner prescribed, for the purpose of discharging the functions of this

to enter into the premises of any controller or processor and inspect or seize records and carry out investigations where the Authority has reasonable grounds to believe that processing poses an imminent risk to the rights of the data subjects;

to carry out periodical evaluations into the manner in which and procedures used for any processing activities carried out by a controller or processor, including the data protection management programme;

to appoint advisory committees consisting of members whose qualifications, experience and powers and duties shall be as prescibed;

to recognize certification and certifying bodies in relation to personal data protection;

to enter into agreements with or engage in any activity, either alone or in conjunction with other apex government or regulatory institutions or international agencies or organizations, responsible for data protection outside Sri Lanka for the purposes of this Act;

to acquire, take and hold any property movable or immovable which may become vested in it or by virtue of any purchase, grants, gifts or otherwise and to sell, mortgage, lease, grant, convey, device, assign, exchange or dispose of, any such movable or immovable property;

to employ such officers and staff including consultants and advisors subject to such terms and conditions of employment to serve as experts as the Authority may consider appropriate for the

with the concurrence of the Minister assigned the subject of Finance, to pay such remuneration and other benefits and to establish provident funds or pension schemes as may be determined by the

to invest its funds in such manner as the Authority may deem necessary;

to open, operate and close bank accounts;

to establish standards in relation to data protection and data storage, data processing, obtaining consent and such other matters as may be necessary for the proper implementation of the provisions of this Act;

to receive grants, gifts or donations whether from local or foreign sources:

to make rules and issue guidelines and directives in respect of the matters for which rules, guidelines and directives are required to be made or issued under this Act; and

to do any other acts as may be necessary or conducive to the attainment of the objects of the