Act of Parliament · As enacted
Personal Data Protection (Amendment) Act 2025
Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.
Official translationFrom Department of Government Printing, unchanged
s 1Short title
This Act may be cited as the Personal Data Protection
(Amendment) Act, No. 22 of 2025.
Section 1 of the Personal Data Protection Act,
No. 9 of 2022 (hereinafter referred to as the “principal enactment”) is hereby amended as follows:-
by the repeal of subsection (3) thereof and the substitution therefor, of the following subsection:-
“(3) All other provisions of this Act except this section, shall come into operation on such date or dates as the Minister may appoint, by
Order published in the Gazette.”; and
by the repeal of subsections (4) and (5) thereof.
Notwithstanding the repeal of subsection (3) of section 1 of the principal enactment, anything duly done under Parts
V, VI, VIII, IX and X prior to the date of commencement of this section, shall be deemed to be valid and continue to be in force.
s 3Amendment of section 12 of the principal enactment
Section 12 of the principal enactment is hereby amended, by the repeal of subsection (2) thereof.
s 4Amendment of section 17 of the principal enactment
Section 17 of the principal enactment is hereby amended as follows:-
[Certifi ed on 30th of October, 2025]
by the repeal of subsection (1) thereof and the substitution therefor, of the following subsection:-
“(1) Where a controller receives a written request from a data subject under section 13,
14, 15, 16 or 18, such controller shall inform in writing to the data subject, without undue delay and within one month of the receipt of such request, whether-
such request was granted; or
such request was refused, with reasons therefor, unless the disclosure of such reasons is prohibited by any written law.”;
by the insertion, immediately after subsection (1)
thereof, of the following subsections:-
“(1A) Where a controller requires an extension of the time period referred to in subsection (1) for reasons assigned, such period may be extended for a further period of two months, which shall not exceed three months from the date of the receipt of the request.
In the event of extension of time period under subsection (1), the controller shall inform the data subject, regarding such extension, prior to the expiry of the period of one month referred to in subsection (1).
A controller shall inform the data subject on the availability of the right of appeal to the
Authority in respect of the refusal of a request made under section 13, 14, 15, 16 or 18.”;
in subsection (2) thereof, by the substitution for the words and fi gures “sections 13, 14, 15 or 16” of the words and fi gures “section 13, 14, 15, 16 or 18”;
in subsection (4) thereof, by the substitution for the words and fi gures “sections 13, 14, 15 or 16,” of the words and fi gures “section 13, 14, 15, 16 or 18,”;
in paragraph (d) of subsection (5) thereof, by the substitution for the words “an heir” of the words
“by an heir”;
by the repeal of subsection (6) thereof and the substitution therefor of the following subsection:-
“(6) A request made by a data subject under section 13, 14, 15, 16 or 18 shall be complied with by the controller free of charge:
Provided however, the Authority may determine by way of rules, the criteria or circumstances under which a fee may be charged by a controller to give effect to such requests.”;
and
by the repeal of subsection (7) thereof.
s 5Amendment of section 18 of the principal enactment
Section 18 of the principal enactment is hereby amended, in subsection (1) thereof, by the substitution for the words “under any written law.”, of the words “under the
Constitution or any written law.”.
s 6Amendment of section 19 of the principal enactment
Section 19 of the principal enactment is hereby amended by the repeal of subsections (1), (2) and (3) thereof and the substitution therefor of the following subsections:-
“(1) Where a controller–
has refused to provide access to personal data under section 13;
has refused to allow withdrawal of consent under section 14(1) or refused to refrain from further processing of personal data under section 14(2);
has refused to rectify or complete personal data under section 15;
has refused to erase personal data under section 16;
has refused a request of the data subject under section 17(2); or
has refused a request to review a decision based solely on automated processing under section 18(1), the data subject may, appeal to the Authority against such refusal in such form, manner and within such period of time as may be prescribed.
Upon receipt of an appeal under subsection (1), the
Authority may determine whether the–
decision of the controller to refuse to provide access to personal data under section 13 was lawful;
decision of the controller to refuse to allow withdrawal of consent under section 14(1) or not to refrain from further processing of personal data under section 14(2) was lawful;
decision of the controller to refuse to rectify or complete personal data under section 15 was lawful;
decision of the controller to refuse the erasure of personal data under section 16 was lawful;
refusal under section 17(2) by the controller was lawful; or
refusal to review a decision based solely on automated processing under section 18(1) was lawful.
Upon receipt of an appeal under subsection (1) and after concluding the necessary investigations, the Authority shall determine within such period as may be prescribed-
whether the appeal is allowed; or
whether the appeal is disallowed, with reasons therefor, and the Authority shall inform to the data subject and the controller of such determination.”.
s 7Amendment of section 20 of the principal enactment
Section 20 of the principal enactment is hereby amended as follows:-
in subsection (1) thereof-
in paragraph (a) thereof, by the substitution for the words “by a ministry, government department or public corporation,”
of the words “by a Ministry or government department,”; and
by the repeal of subparagraph (iii) of paragraph (b) thereof and the substitution therefor of the following subparagraph:-
“(iii) categories of processing which results in a risk of harm affecting the rights of the data subjects protected under this Act, based on the nature of processing and its impact on the data subjects, as may be determined by the Authority by way of guidelines made under this
Act.”; and
in subsection (5) thereof-
in paragraph (a) thereof, by the substitution for the words “processing requirements provided under this Act or any other written law;” of the words “processing obligations or requirements, as the case may be, under this
Act or any other written law;”;
by the repeal of paragraph (b) thereof and the substitution therefor of the following paragraph: -
“(b) advise the controller or processor on how to comply with the provisions of this Act;”; and
in paragraph (e) thereof, by the substitution for the words “data protection.” of the words
“personal data protection.”.
s 8Amendment of section 24 of the principal enactment
Section 24 of the principal enactment is hereby amended as follows:-
in subsection (3) thereof, by the substitution for the words “Data Protection offi cer, where designated,”
of the words “Data Protection Offi cer,”; and
by the repeal of subsection (5) thereof and the substitution therefor of the following subsection:-
“(5) Upon a written request from the
Authority, the controller shall submit to the
Authority the personal data protection impact assessment required to be carried out under this section and provide any other information relating to such assessment, as may be required by the Authority.”.
s 9Amendment of section 25 of the principal enactment
Section 25 of the principal enactment is hereby amended as follows:-
in subsection (1) thereof, by the substitution for the words “under this Act or any written law,” of the words “under this Act,”;
by the repeal of subsections (2), (3), (4), (5) and (6)
thereof;
in subsection (7) thereof, by the substitution for the words and fi gures “in section 24 (1) and where such processing”, of the words and fi gures
“in section 24 (1) where such processing”; and
in the marginal note thereto, by the substitution for the words “risks of harm and the requirement for prior consultation” of the words “risks of harm”.
s 10Replacement of section 26 of the principal enactment
Section 26 of the principal enactment is hereby repealed and the following section is substituted therefor:-
26. (1) A controller or processor may engage in cross-border data fl ows, only where such controller or processor, ensures compliance with the provisions of Part I,
Part II and sections 20, 21, 22, 23, 24 and 25, as the case may be.
For the purpose of ensuring compliance under subsection (1), a controller or processor shall adopt such instruments as may be specifi ed by a directive issued by the
Authority under paragraph (c) of section 33, to ensure binding and enforceable commitments of the recipient in the third country to ensure appropriate safeguards to the rights of the data subjects and remedies available under this Act.
Notwithstanding the provisions of subsection (1), a controller or processor may engage in cross-border data fl ows, if-
the data subject has explicitly consented to the proposed cross-border data fl ow, after having been informed of the possible risks of such processing for the data subject;
the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre contractual measures taken by the controller at the request of the data subject;
“Cross-border data flow
the transfer is necessary for the establishment, exercise or defence of legal claims relating to the data subject;
the transfer is necessary for reasons of public interest as defi ned in item (g) of Schedule I to this Act;
the transfer is necessary to respond to an emergency that threatens the life, health or safety of the data subject or where his legal guardian is physically or legally incapable of giving consent;
the transfer constitutes only a transit of personal data through Sri Lanka;
or
such processing is permitted under any other conditions as may be prescribed under this Act.
A controller or processor who is a public authority shall not engage in cross-border data flows in respect of the categories of personal data as may be prescribed under subsection (5).
The Minister may, prescribe the categories of personal data for the purposes of subsection (4), upon a request made by the
Authority or a controller or processor who is a public authority in consultation with the relevant statutory or regulatory body.”.
s 11Insertion of new section 51A in the principal enactment
The following new section is hereby inserted immediately after section 51 of the principal enactment and shall have effect as section 51A thereof:-
51A. The Authority may, from time to time, issue guidelines in respect of the matters specifi ed in this Act, including the sectoral guidelines referred to in paragraph (o) of section 33, formulated by the advisory committees and approved by the Authority and the matters relating to the
Data Protection Management Programme as specifi ed in section 12.”.
s 12Amendment of section 52 of the principal enactment
Section 52 of the principal enactment is hereby amended in subsection (2) thereof, by the substitution for the words “within twenty-four months” of the words “within thirty six months”.
s 13Amendment of section 53 of the principal enactment
Section 53 of the principal enactment is hereby amended by the repeal of paragraph (b) of subsection (2)
thereof.
s 14Amendment of section 56 of the principal enactment
Section 56 of the principal enactment is hereby amended as follows:-
by the repeal of the defi nition of the expression
“Data Protection Offi cer” and the substitution therefor of the following defi nition:-
““Data Protection Offi cer” means, the person designated or appointed under section
“Guidelines
20 and includes a third party who is not directly employed by a controller or processor, but fulfi ls the responsibilities under section 20(5);”;
by the repeal of the defi nition of the expression
“public authority” and the substitution therefor of the following defi nition:-
““public authority” means, a Ministry, any
Department, Provincial Council, local authority, or a Ministry or Department of a
Provincial Council but does not include-
a public corporation; or
a company incorporated under the
Companies Act, No. 07 of 2007;”;
and
by the repeal of the defi nition of the expression
“third country” and the substitution therefor of the following defi nition:-
““third country” means, any other territory or country other than Sri Lanka;”.
s 15Amendment of Schedule VI to the principal enactment
Schedule VI to the principal enactment is hereby amended in paragraph (2) of item 6 thereof, by the substitution for the words “The Director-General shall” of the words “The Chairperson shall”.
s 16Sinhala text to prevail in case of inconsistency
In the event of any inconsistency between the Sinhala and Tamil texts of this Act, the Sinhala text shall prevail.