Processes personal data, in Sri Lanka

Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 · Read the law's page

• An app must give a data subject in Sri Lanka a way to access, withdraw consent for, rectify, or erase their personal data, including a stored voiceprint or faceprint, and must respond to a written request within one month, extendable by up to two further months with notice; a refusal is appealable to the Data Protection Authority.

Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.35, 38 · Read the law's page

• An app processing the personal data of a person in Sri Lanka, including a biometric identifier, answers to the Data Protection Authority, which may investigate on complaint or its own initiative and direct corrective action, cessation of non-compliant processing, or compensation to an aggrieved person; Sri Lanka gives a data subject no standalone civil right of action of their own, only this regulator-administered compensation route.

Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, Schedule I, ss.5, 18(1), 20-25 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Sri Lanka, including a voiceprint or faceprint, must have a lawful basis under Schedule I, ordinarily consent, contract necessity, or a legitimate interest satisfying a balancing test, and must give a data subject a way to seek review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights.

Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.23 · Read the law's page

• An app that suffers a personal data breach in Sri Lanka, including one involving a biometric identifier, must notify the Data Protection Authority in the form, manner, and time a rule made under the Act determines; whether and when the affected individual must also be told is set by a rule not yet located.

Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26 · Read the law's page

• An app transferring the personal data of a person in Sri Lanka abroad, including a voiceprint or other biometric identifier, must ensure it complies with Parts I and II and sections 20 to 25, and must adopt the safeguard instruments the Authority specifies or rely on one of section 26(3)'s derogations, such as the data subject's explicit consent after being told of the risks. A public authority may not send abroad the categories of personal data the Minister prescribes.