Skip to content
srilawsby aturio
As enacted
Contents

Part I · Processing of Personal Data

6. Obligation to define a purpose for personal data processing

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

(1)

Every controller shall, ensure that personal data is processed for a—

(a)

specified;

(b)

explicit; and

(c)

legitimate, purposes and such personal data shall not be further processed in a manner which is incompatible with such purposes.

(2)

Subject to the provisions of section 10 of this Act, further processing of such personal data by a controller for archiving purposes in the public interest, scientific research, historical research or statistical purposes shall not be considered to be incompatible with the initial purposes referred to in paragraphs (a), (b) and (c) of subsection (1).

Read on from s 7

Part II

Rights of Data Subjects

Read on from Part II

Part III

Controllers and Processors

Read on from Part III

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X

Schedules