Sri LankaPersonal Data Protection Act, comprehensive regime and lawful basis
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Sri Lanka, including a voiceprint or faceprint, must have a lawful basis under Schedule I, ordinarily consent, contract necessity, or a legitimate interest satisfying a balancing test, and must give a data subject a way to seek review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the legitimate interest ground in Schedule I, which applies "except where such interests are overridden by the interests of the data subject which require protection of personal data", allow an app to process a user's personal data to train a model or build a profile, and what balancing must the controller be able to show?
- What amounts to an "irreversible and continuous impact" on the rights and freedoms of a data subject under section 18(1), so that a decision "based solely on automated processing" falls within the right to request review?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 24 makes a controller carry out a personal data protection impact assessment before systematic, extensive or monitoring processing, and section 24(5), as substituted in 2025, makes it produce the assessment to the Authority on a written request, which it cannot do without keeping it. No log or register is named, and no period for keeping the assessment is set. Sections 20 to 23 and 25 add the data protection officer, processor contracts, breach notice and risk mitigation, none of which names a record. Section 12 (the Data Protection Management Programme and its catalogued records) is not among the sections this row cites and is not borrowed here. The Schedule I lawful-basis conditions and section 18(1) name no record. The row has no scope clause among its cited provisions.
- Kind
- Implicit
- As of
- Provision
- Section 24(1) and (5), within sections 20 to 25
- Trigger
- personal_data_processing
What this law does
Lawful basis, referenced by s.5 against Schedule I, follows a General Data Protection Regulation (GDPR) Article 6 shape: consent, contract necessity, legal obligation, vital interests, a public-interest task, or legitimate interest subject to a balancing test. Controller and processor duties are allocated at ss.20-25, with processors bound by written instructions and sub-processor flow-down duties.
Section 18(1) gives every data subject the right to request review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights and freedoms, subject to listed exceptions (authorized by law, authorized by the Authority, based on consent, or contract necessity). Section 5 and Part III (sections 20 to 25) come into operation on , the day appointed by an Order gazetted on . That Order does not name Part II, which holds section 18, so section 18 awaits a separate commencement Order.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .