Sri LankaPersonal Data Protection Act, special categories and biometric data
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that derives a faceprint, voiceprint, or other biometric identifier used to uniquely identify a person in Sri Lanka must treat it as a special category of personal data and satisfy one of Schedule II's conditions, ordinarily the data subject's consent, before processing it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "biometric data for the purpose of uniquely identifying a natural person" in the definition of special categories of personal data reach a faceprint or voiceprint that an app derives to group or recommend, not to identify one person?
- Is a voiceprint within the "physical, physiological or behavioral characteristics of a natural person" that the definition of biometric data names?
What it makes you log
Logging duty
Section 56 defines the special categories and biometric data, and Schedule II lists the conditions for processing a special category: consent, employment and public-health necessity, emergency, data made public by the data subject, legal claims, public interest with safeguards, health care, and archiving or research. None of them requires a person to make, keep or produce a log or record. The duty to demonstrate consent sits in Schedule III, which this row does not cite, so it is not borrowed here.
- Kind
- None
- As of
What this law does
Biometric data is defined at s.56 as personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm unique identification, including facial images, dactyloscopic (fingerprint) data, or iris-related data. Biometric data used for unique identification is one of the enumerated special categories of personal data.
Schedule II conditions processing of a special category on the data subject's consent (or a parent or guardian's for a child) unless another written law prohibits it regardless of consent, employment or social-security or defined public-health necessity, emergency necessity, data manifestly made public by the data subject, legal-claims necessity, or public interest under a written law with safeguards.
The operative definition's technology-neutral "physical, physiological or behavioral characteristics" language reaches a voice-derived identifier on its own terms, though the illustrative list names only facial images, fingerprint, and iris data, not voice specifically. Part I (processing of personal data) comes into operation on under an Order gazetted on . The Schedule II conditions apply through section 5, in Part I.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .