Duty LXD-4081
Makes justice decisions, in Sri Lanka
Each law's tag says when it binds: proposed proposed from a date not yet set not yet in force
Digital Economy Bill (in drafting)proposed0 lines
Cabinet decision, , instructing the Legal Draftsman's Department to prepare a Digital Economy Bill
Personal Data Protection Act, data subject rightsfrom a date not yet set1 line
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 · Read the law's page
- An app must give a data subject in Sri Lanka a way to access, withdraw consent for, rectify, or erase their personal data, including a stored voiceprint or faceprint, and must respond to a written request within one month, extendable by up to two further months with notice; a refusal is appealable to the Data Protection Authority.
Personal Data Protection Act, comprehensive regime and lawful basisfrom , in 7 weeks1 line
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, Schedule I, ss.5, 18(1), 20-25 · Read the law's page
- An app that collects, uses, or discloses the personal data of an individual in Sri Lanka, including a voiceprint or faceprint, must have a lawful basis under Schedule I, ordinarily consent, contract necessity, or a legitimate interest satisfying a balancing test, and must give a data subject a way to seek review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights.