Sri LankaPersonal Data Protection Act, cross-border transfer of personal data
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Sri Lanka abroad, including a voiceprint or other biometric identifier, must ensure it complies with Parts I and II and sections 20 to 25, and must adopt the safeguard instruments the Authority specifies or rely on one of section 26(3)'s derogations, such as the data subject's explicit consent after being told of the risks. A public authority may not send abroad the categories of personal data the Minister prescribes.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Authority of Sri Lanka (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority's circular of refers to a draft directive that recognizes several instruments.
- As of
- Guidance link
- https://www.dpa.gov.lk/media/DPA_Circular_012026_E.pdf
- Guidance body
- Data Protection Authority of Sri Lanka
- Open questions
- Which instruments does the Authority specify in "a directive issued by the Authority under paragraph (c) of section 33" for the commitments section 26(2) requires of a recipient in a third country?
- What other "conditions as may be prescribed under this Act" does section 26(3)(g) permit as a basis for a cross-border data flow?
What it makes you log
Logging duty
Section 26, as substituted by Act No. 22 of 2025, conditions a cross-border flow on compliance with Parts I and II and sections 20 to 25, on the transfer instruments the Authority specifies by directive, or on a listed derogation, and bars a public authority from sending abroad the categories the Minister prescribes. It requires no log, register or record of a transfer and names no check of one. The section has no scope clause of its own.
- Kind
- None
- As of
What this law does
A controller or processor may engage in cross-border data flows only where it ensures compliance with Part I, Part II and sections 20 to 25, as the case may be (section 26(1), as substituted in 2025). To do so it must adopt the instruments the Authority specifies by directive, binding and enforceable commitments from the recipient in the third country that give the data subject appropriate safeguards and remedies (section 26(2)).
Section 26(3) permits a flow despite subsection (1) where the data subject has explicitly consented after being told of the risks, the transfer is necessary for a contract with the data subject or for pre-contractual steps at the data subject's request, the transfer is necessary for legal claims or for public interest as defined in item (g) of Schedule I, the transfer responds to an emergency threatening life, health or safety, the transfer is only a transit of personal data through Sri Lanka, or another prescribed condition permits it.
A public authority may not engage in cross-border flows of the categories of personal data the Minister prescribes (section 26(4) and (5)). Part III, which holds section 26, comes into operation on under an Order gazetted on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .