Sri LankaPersonal Data Protection Act, breach notification duties
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.23
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a personal data breach in Sri Lanka, including one involving a biometric identifier, must notify the Data Protection Authority in the form, manner, and time a rule made under the Act determines; whether and when the affected individual must also be told is set by a rule not yet located.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority's circular of describes draft rules on personal data breach notification as available.
- As of
- Open questions
- In what form and manner, and within what period, must a controller notify the Authority of a "personal data breach" under section 23(1), which leaves those details to "rules made under this Act"?
- In what circumstances must "the affected data subject" be notified of a personal data breach under section 23(2)(b)?
What it makes you log
Logging duty
Section 23 requires a controller to notify the Authority of a personal data breach in the form, manner and time that rules set, and requires the Authority to make rules on when the Authority and the affected data subject are told and what the notice holds. It names no record the controller keeps, no register of breaches and no check of one: a notice is a report sent out, not a log. The row's text is the Act as certified in 2022, and Act No. 22 of 2025 does not amend section 23. The rules under section 52 that would set the time and form were not located.
- Kind
- None
- As of
What this law does
Section 23(1) requires a controller to notify the Authority of a personal data breach, in the form, manner, and within the time rules made under the Act determine. Section 23(2) requires the Authority to set, by rule, the circumstances triggering notice to the Authority, the circumstances triggering notice to the affected data subject, and the form and content of the notification.
The duty to notify the Authority comes into operation on , with the rest of Part III, under an Order gazetted on . The threshold, timeline, and whether the affected individual must be told are deferred entirely to rules made under section 52, which are not located.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .