Sri LankaPersonal Data Protection Act, special categories and biometric data
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 18 March 2025.
A sensitive categories rule binding public and private bodies.
As of 29 August 2026.
What it requires
- An app that derives a faceprint, voiceprint, or other biometric identifier used to uniquely identify a person in Sri Lanka must treat it as a special category of personal data and satisfy one of Schedule II's conditions, ordinarily the data subject's consent, before processing it.
What it reaches
Excludes recording-derived identifiersNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Biometric data is defined at s.56 as personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm unique identification, including facial images, dactyloscopic (fingerprint) data, or iris-related data. Biometric data used for unique identification is one of the enumerated special categories of personal data.
Schedule II conditions processing of a special category on the data subject's consent (or a parent or guardian's for a child) unless another written law prohibits it regardless of consent, employment or social-security or defined public-health necessity, emergency necessity, data manifestly made public by the data subject, legal-claims necessity, or public interest under a written law with safeguards.
The operative definition's technology-neutral "physical, physiological or behavioral characteristics" language reaches a voice-derived identifier on its own terms, though the illustrative list names only facial images, fingerprint, and iris data, not voice specifically.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
Read the law
official statute text, Parliament of Sri Lanka
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.