4. Amendment of section 17 of the principal enactment

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

Section 17 of the principal enactment is hereby amended as follows:-

[Certiﬁ ed on 30th of October, 2025]

(1)

by the repeal of subsection (1) thereof and the substitution therefor, of the following subsection:-

“(1) Where a controller receives a written request from a data subject under section 13,

14, 15, 16 or 18, such controller shall inform in writing to the data subject, without undue delay and within one month of the receipt of such request, whether-

(a)

such request was granted; or

(b)

such request was refused, with reasons therefor, unless the disclosure of such reasons is prohibited by any written law.”;

(2)

by the insertion, immediately after subsection (1)

thereof, of the following subsections:-

“(1A) Where a controller requires an extension of the time period referred to in subsection (1) for reasons assigned, such period may be extended for a further period of two months, which shall not exceed three months from the date of the receipt of the request.

(1B)

In the event of extension of time period under subsection (1), the controller shall inform the data subject, regarding such extension, prior to the expiry of the period of one month referred to in subsection (1).

(1C)

A controller shall inform the data subject on the availability of the right of appeal to the

Authority in respect of the refusal of a request made under section 13, 14, 15, 16 or 18.”;

(3)

in subsection (2) thereof, by the substitution for the words and ﬁ gures “sections 13, 14, 15 or 16” of the words and ﬁ gures “section 13, 14, 15, 16 or 18”;

(4)

in subsection (4) thereof, by the substitution for the words and ﬁ gures “sections 13, 14, 15 or 16,” of the words and ﬁ gures “section 13, 14, 15, 16 or 18,”;

(5)

in paragraph (d) of subsection (5) thereof, by the substitution for the words “an heir” of the words

“by an heir”;

(6)

by the repeal of subsection (6) thereof and the substitution therefor of the following subsection:-

“(6) A request made by a data subject under section 13, 14, 15, 16 or 18 shall be complied with by the controller free of charge:

Provided however, the Authority may determine by way of rules, the criteria or circumstances under which a fee may be charged by a controller to give effect to such requests.”;

and

(7)

by the repeal of subsection (7) thereof.

Read on from s 5