Skip to content
srilawsby aturio
As enacted
Contents

Part I · Processing of Personal Data

7. Obligation to confine personal data processing to the defined purpose

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

Every controller shall ensure that personal data that is processed shall be—

(a)

adequate;

(b)

relevant; and

(c)

proportionate, to the extent as is necessary in relation to the purpose for which such data shall be collected or processed.

Read on from s 8

Part II

Rights of Data Subjects

Read on from Part II

Part III

Controllers and Processors

Read on from Part III

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X

Schedules