Skip to content
srilawsby aturio
As enacted
Contents

Part I · Processing of Personal Data

5. Obligation to process personal data in a lawful manner

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

The processing of personal data shall be lawful if a controller is in compliance with—

(a)

any condition specified in Schedule I hereto;

(b)

any condition specified in Schedule II hereto in the case of processing special categories of personal data;

(c)

all the conditions specified in Schedule III hereto in the case of processing personal data based on the consent of the data subject under item (a) of

Schedule I or under item (a) of Schedule II hereto;

or

(d)

all the conditions specified in Schedule IV hereto in the case of processing personal data in respect of criminal investigations.

Read on from s 6

Part II

Rights of Data Subjects

Read on from Part II

Part III

Controllers and Processors

Read on from Part III

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X

Schedules