Sri Lanka

Section 23(1) requires a controller to notify the Authority of a personal data breach, in the form, manner, and within the time rules made under the Act determine. Section 23(2) requires the Authority to set, by rule, the circumstances triggering notice to the Authority, the circumstances triggering notice to the affected data subject, and the form and content of the notification.

The duty to notify the Authority comes into operation on 1 January 2027, with the rest of Part III, under an Order gazetted on 22 July 2026. The threshold, timeline, and whether the affected individual must be told are deferred entirely to rules made under section 52, which are not located.

Lawful basis, referenced by s.5 against Schedule I, follows a General Data Protection Regulation (GDPR) Article 6 shape: consent, contract necessity, legal obligation, vital interests, a public-interest task, or legitimate interest subject to a balancing test. Controller and processor duties are allocated at ss.20-25, with processors bound by written instructions and sub-processor flow-down duties.

Section 18(1) gives every data subject the right to request review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights and freedoms, subject to listed exceptions (authorized by law, authorized by the Authority, based on consent, or contract necessity). Section 5 and Part III (sections 20 to 25) come into operation on 1 January 2027, the day appointed by an Order gazetted on 22 July 2026. That Order does not name Part II, which holds section 18, so section 18 awaits a separate commencement Order.

A controller or processor may engage in cross-border data flows only where it ensures compliance with Part I, Part II and sections 20 to 25, as the case may be (section 26(1), as substituted in 2025). To do so it must adopt the instruments the Authority specifies by directive, binding and enforceable commitments from the recipient in the third country that give the data subject appropriate safeguards and remedies (section 26(2)).

Section 26(3) permits a flow despite subsection (1) where the data subject has explicitly consented after being told of the risks, the transfer is necessary for a contract with the data subject or for pre-contractual steps at the data subject's request, the transfer is necessary for legal claims or for public interest as defined in item (g) of Schedule I, the transfer responds to an emergency threatening life, health or safety, the transfer is only a transit of personal data through Sri Lanka, or another prescribed condition permits it.

A public authority may not engage in cross-border flows of the categories of personal data the Minister prescribes (section 26(4) and (5)). Part III, which holds section 26, comes into operation on 1 January 2027 under an Order gazetted on 22 July 2026.

Data subjects have rights of access (s.13), withdrawal of consent and cessation of further processing (s.14), rectification and completion (s.15), erasure (s.16), and (s.18) review of a decision based solely on automated processing. Section 17, amended in 2025, requires the controller to respond in writing within one month of a written request under ss.13-16 or 18, extendable by up to two further months with notice given before the original month expires.

Section 19, also amended in 2025, gives a right of appeal to the Authority against a controller's refusal on any of these grounds, with the Authority empowered to determine lawfulness and to direct compensation under s.35(2)(c). The Order gazetted on 22 July 2026 names only sections 2 and 3, Part I and Part III, and does not name Part II.

The Data Protection Authority (Part V, operative since July 2023, with the Chairman and Board appointed October 2023) is a body corporate that may sue and be sued. Under section 35, on complaint or its own initiative, the Authority may investigate a controller or processor and, after a hearing, direct it to cease non-compliant processing, take corrective action, or pay compensation to an aggrieved person who has suffered harm, loss, or damage.

Failure to comply with a directive triggers a monetary penalty under section 38 of up to Rs 10,000,000 per non-compliance, doubling for each subsequent one, collected by the Authority (net of any compensation payable) and credited to the Consolidated Fund; unpaid penalties are recoverable via the Magistrate Court of Colombo.

No standalone civil right of action was found; the Authority's directive-and-compensation mechanism under section 35(2)(c) is the only individual remedy, and it is regulator-administered rather than a court claim the data subject brings directly. Part V, which holds section 35, came into operation on 17 July 2023. The Order gazetted on 22 July 2026 does not name Part VII, which holds section 38.

Biometric data is defined at s.56 as personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm unique identification, including facial images, dactyloscopic (fingerprint) data, or iris-related data. Biometric data used for unique identification is one of the enumerated special categories of personal data.

Schedule II conditions processing of a special category on the data subject's consent (or a parent or guardian's for a child) unless another written law prohibits it regardless of consent, employment or social-security or defined public-health necessity, emergency necessity, data manifestly made public by the data subject, legal-claims necessity, or public interest under a written law with safeguards.

The operative definition's technology-neutral "physical, physiological or behavioral characteristics" language reaches a voice-derived identifier on its own terms, though the illustrative list names only facial images, fingerprint, and iris data, not voice specifically. Part I (processing of personal data) comes into operation on 1 January 2027 under an Order gazetted on 22 July 2026. The Schedule II conditions apply through section 5, in Part I.

Section 3 makes it an offence to intentionally secure access to a computer or to information held in it, knowing or having reason to believe there is no lawful authority for that access; section 4 raises the same conduct to a second offence where it is done with intent to commit a further offence.

Neither section requires infringing a security measure or defeating any technical control, so the provision's reach over a public, unauthenticated page turns entirely on whether the accessor had lawful authority, a question no reported Sri Lankan decision has tested against a scraping fact pattern. Section 5 separately criminalises causing a computer to perform a function that the person knows or has reason to believe will result in unauthorised modification or damage.

Section 6 criminalises intentionally causing danger or imminent danger to national security, the national economy, or public order. Section 7 criminalises buying, receiving, retaining, selling, downloading, uploading, copying or otherwise dealing with information known or believed to have been obtained from a computer without lawful authority by another person. The Act's own section 1 defers its commencement to a date the Minister appoints by Gazette Order.

The revised edition of the Laws of Sri Lanka gives 9 July 2007 as the Act's date of commencement. No notice of the Minister's Order has been located.

Section 11(1)-(2) gives Sri Lanka an American-style fair use defence: the fair use of a work for purposes such as criticism, comment, news reporting, teaching, scholarship or research is not an infringement, judged by the purpose and character of the use (including whether it is commercial), the nature of the work, the amount and substantiality of the portion used, and the effect on the potential market for or value of the work.

Section 11(3) provides that the acts of fair use include the circumstances specified in section 12. Section 12(2)(c) excludes reproduction of the whole or a substantial part of a database from the private reproduction that section 12(1) permits. Section 8(c) excludes "news of the day" from copyright protection altogether.

Section 7(1)(b) protects a collection of works or a collection of mere data (a database), in machine-readable or other form, as a work only where the collection is original by reason of the selection, coordination, or arrangement of its contents; the underlying data itself is not protected, and Sri Lanka confers no sui generis database right of the kind that protects a compilation assembled through investment or effort alone regardless of originality.

The Speaker's certificate on the Act is dated 12th November, 2003. Under Article 80(1) of the Constitution, a Bill passed by Parliament becomes law when the certificate of the Speaker is endorsed on it.

Banking Act Directions No. 16 of 2021 apply to all licensed banks, including operations conducted through agents and third-party service providers. Banking Act Directions No. 16 of 2021 are dated 09 December 2021. The Monetary Board of the Central Bank of Sri Lanka is empowered to issue Directions to all licensed commercial banks regarding the manner in which any aspect of their business is conducted.

The Monetary Board is empowered to give Directions to licensed specialised banks regarding the manner in which any aspect of their business is conducted. The framework in Schedule I requires a licensed bank to establish an Information Security Committee as the apex management level body responsible for information security and technology resilience.

The framework requires a licensed bank to appoint a Chief Information Security Officer as the executive officer responsible for its information security. The framework requires a Security Operations Center to be operational on a 24 x 7 basis. The framework requires a licensed bank to have an up to date incident response plan approved by its Board of Directors, detailing procedures for incident escalation, remediation, recovery, and communication with internal and external stakeholders.

The framework requires critical information systems to be subjected to penetration tests at least annually. The framework requires a recovery time objective of less than 4 hours for the critical information systems of a domestic systemically important bank and less than 6 hours for those of any other licensed bank. The general deadline for requirements without an extended deadline is 31.12.2022.

Banking Act Directions No. 05 of 2023, dated 08.12.2023, are listed as amendments to Banking Act Directions No. 16 of 2021. Section 80 of the Banking Act makes it an offence for a director, manager, officer or employee of a licensed bank to fail to comply with a direction issued by the Monetary Board under the Act.

Circular No. 02 of 2025 of the Central Bank of Sri Lanka is issued to licensed commercial banks and licensed specialised banks. The Circular is dated 07 May 2025. The Circular requires licensed banks to report IT and cybersecurity incidents to the Director, Bank Supervision Department, by email. The Circular sets three clocks: an immediate report within 2 hours of detection, a detailed report within 14 days of detection, and a quarterly report within 15 days after the end of each quarter.

The Circular defines a cybersecurity incident as an event that compromises the confidentiality, integrity or availability of a bank’s systems and information. The Circular revokes the Central Bank’s circular of 25.01.2016 on reporting cybersecurity events.

Section 12(3) permits, without the copyright owner's authorization, the reproduction of a short part of a published work in the form of a quotation, provided the reproduction is compatible with fair practice, does not exceed the extent justified by its purpose, and is accompanied by an indication of the source and the author's name.

Section 12(6)(a) permits the reproduction, in a newspaper or periodical or by broadcast or other communication to the public, of an article on current economic, political or religious topics published in another newspaper or periodical, unless the copyright owner has expressly reserved that right on the copies or in connection with the broadcast.

Section 12(6)(b) permits, for the purpose of reporting current events, the reproduction and broadcasting or other communication to the public of short excerpts of a work seen or heard in the course of those events, to the extent justified by that purpose. Section 8(c) separately excludes "news of the day" from copyright protection altogether, so the underlying facts of a news report carry no protection independent of these exceptions.

None of these provisions carries a headline-length or short-extract cap distinct from the fair-practice and purpose-justified tests they state, and no reported Sri Lankan decision applies any of them to a systematic news aggregator rather than an individual quoting or excerpting a published work. The Speaker's certificate on the Act is dated 12th November, 2003. Under Article 80(1) of the Constitution, a Bill passed by Parliament becomes law when the certificate of the Speaker is endorsed on it.