The Personal Data Protection Act of Sri Lanka was passed in parliament and was certified by the Speaker on 19th March 2022 and is the principal legislation that deals with the protection of personal data in Sri Lanka. For the large part the Act being in line with global legislation to include the GDPR, filling a long-felt lacuna in the area of information privacy in Sri Lanka.
The Act being brought into force, has however a phased – out application (as detailed in this writing) providing for a cooling off period for relevant parties to have the necessary processes, controls in place and also have carried out the required training for personnel who would be involved in the process.
The fundamental provisions being the protection of personal data by specifying the rights of the data subjects, the obligations of the Controller and Processors, the instances in which the processing of personal data becomes lawful, the manner in which personal data should be processed, provisions with regard to cross border data transfers and the definitions of the key legal terms used in the Act.
Furthermore, the Act establishes a data protection regulator named the Data Protection Authority (the “Authority”) empowered to inter-alia act on complaints received or on its motion and make directives to Controllers and Processors including the right to impose penalties for non-compliance. A right of appeal from the decisions of the Authority lies to the Court of Appeal which may affirm or revise the decisions of the Authority.
The phased-out application will bring into force Parts I-III, to wit; Processing of Data, Rights of Data Subjects and Controllers and Processors on a date not earlier than 18 months and not later than 36 months from the date of the certificate of the Speaker. Part IV – Use of Personal Data to Disseminate Solicited Messages on a date not earlier than 24 months and not later than 48 months from the date of the certificate of the Speaker; with Part V – The Data Protection Authority on a date not later than the date appointed by the Minister for the coming into operation of all other Parts.
