Personal Data Protection Act, cross-border transfer of personal data

Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 18 March 2025.

A cross border transfer rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app transferring the personal data of a person in Sri Lanka abroad, including a voiceprint or other biometric identifier, must rely on an adequacy decision, Authority-specified appropriate safeguards, or one of section 26(5)'s derogations, such as explicit informed consent after risk disclosure. A public authority defaults to processing data only within Sri Lanka unless the Authority has affirmatively classified the category for third-country processing.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

For a public authority, personal data shall be processed only in Sri Lanka and not in a third country, unless the Authority classifies categories permitted for third-country processing pursuant to a Ministerial adequacy decision, reviewed at least every two years (s.26(1)-(2)), a default-localization rule.

For a private controller or processor, transfer is permitted to a country covered by an adequacy decision, or elsewhere only with appropriate safeguards specified by the Authority (s.26(4)), or, absent both, only under listed derogations: explicit informed consent after risk disclosure, contract necessity, legal-claims necessity, public interest, or a life-or-safety emergency (s.26(5)).

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

Read the law

official statute text, Parliament of Sri Lanka

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app