Sri LankaPersonal Data Protection Act, Data Protection Authority and penalties
Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.35, 38
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- An app processing the personal data of a person in Sri Lanka, including a biometric identifier, answers to the Data Protection Authority, which may investigate on complaint or its own initiative and direct corrective action, cessation of non-compliant processing, or compensation to an aggrieved person; Sri Lanka gives a data subject no standalone civil right of action of their own, only this regulator-administered compensation route.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
The Authority has published draft regulations on inquiry procedure under section 35, dated , for public consultation.
- As of
- Open questions
- What procedure governs an inquiry under section 35(1), which the Authority may conduct "in accordance with the procedure as may be prescribed", and within what time must a controller comply with a directive issued under section 35(2)?
- Does a penalty under section 38(1), which applies where a controller or processor "fails to comply with a directive issued under the provisions of section 35", reach a first contravention that no directive has yet addressed?
What it makes you log
Logging duty
Section 35 lets the Authority inquire into a suspected contravention and, after a hearing, direct a controller or processor to stop, to take corrective steps or to pay compensation, and section 38 sets the penalty for ignoring a directive. Neither section imposes a duty to keep, log or produce a record, and neither names an inspection or a demand for records. The Authority's separate powers to inspect information and records are in a section this row does not cite, so they are not borrowed here.
- Kind
- None
- As of
What this law does
The Data Protection Authority (Part V, operative since July 2023, with the Chairman and Board appointed October 2023) is a body corporate that may sue and be sued. Under section 35, on complaint or its own initiative, the Authority may investigate a controller or processor and, after a hearing, direct it to cease non-compliant processing, take corrective action, or pay compensation to an aggrieved person who has suffered harm, loss, or damage.
Failure to comply with a directive triggers a monetary penalty under section 38 of up to Rs 10,000,000 per non-compliance, doubling for each subsequent one, collected by the Authority (net of any compensation payable) and credited to the Consolidated Fund; unpaid penalties are recoverable via the Magistrate Court of Colombo.
No standalone civil right of action was found; the Authority's directive-and-compensation mechanism under section 35(2)(c) is the only individual remedy, and it is regulator-administered rather than a court claim the data subject brings directly. Part V, which holds section 35, came into operation on . The Order gazetted on does not name Part VII, which holds section 38.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .