Sri LankaPersonal Data Protection Act, data subject rights
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19
A data subject rights rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- An app must give a data subject in Sri Lanka a way to access, withdraw consent for, rectify, or erase their personal data, including a stored voiceprint or faceprint, and must respond to a written request within one month, extendable by up to two further months with notice; a refusal is appealable to the Data Protection Authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority has published draft regulations on the exercise of data subjects' rights and appeals, dated , for public consultation.
- As of
- Open questions
- What "form, manner and within such period of time as may be prescribed" will govern an appeal to the Authority under section 19(1) against a controller's refusal?
- When may a controller charge a fee for a request under section 13, 14, 15, 16 or 18, given that the Authority "may determine by way of rules, the criteria or circumstances under which a fee may be charged"?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 17(3) makes a controller record the reasons for refusing a data subject's request and submit those records to the Authority on its written request. Act No. 22 of 2025 widens the refusals the subsection reaches to requests under section 18 (automated decisions) and leaves subsection (3) as it was. The rest of the row (access, withdrawal, rectification, erasure, the one-month answer and the appeal to the Authority) sets no further record. The record's contents are the reasons for refusal, which the vocabulary has no value for, and the Act sets no period for keeping it.
- Kind
- Explicit
- As of
- Provision
- Section 17(3), within sections 13 to 19
- Trigger
- personal_data_processing
What this law does
Data subjects have rights of access (s.13), withdrawal of consent and cessation of further processing (s.14), rectification and completion (s.15), erasure (s.16), and (s.18) review of a decision based solely on automated processing. Section 17, amended in 2025, requires the controller to respond in writing within one month of a written request under ss.13-16 or 18, extendable by up to two further months with notice given before the original month expires.
Section 19, also amended in 2025, gives a right of appeal to the Authority against a controller's refusal on any of these grounds, with the Authority empowered to determine lawfulness and to direct compensation under s.35(2)(c). The Order gazetted on names only sections 2 and 3, Part I and Part III, and does not name Part II.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .