Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Create an account
Join our community for free to access exclusive whitepapers, reports, and regulatory information.
Sri Lanka: Parliament publishes Personal Data Protection Act
The Parliament of Sri Lanka published, on 22 March 2022, the Personal Data Protection Act, No. 9 of 2022 ('PDPA'), following its passage on 9 March 2022 and subsequent certification on 19 March 2022. In particular, the PDPA aims to strengthen the rights of data subjects, as well as provide for the establishment of the Data Protection Authority of Sri Lanka ('the Authority').
Compared to the initial bill presented to Parliament in January 2022, the PDPA, among other things, includes various amendments to:
- lower the age threshold for children from the age of 18 to the age of 16;
- redefine the obligations of processors;
- introduce new exceptions under which personal data may be processed outside of Sri Lanka;
- enhance the powers of the Authority, particularly with the introduction of a Board of Directors as the administrative body of the Authority; and
- introduce provisions allowing the Authority to issue licences to controllers and processors for the purpose of regulating identity management and related services.
Finally, with the exception of certain provisions, the PDPA is due to come into operation on a date notified by the relevant Minister, although this should be no earlier than 18 months, and no later than 36 months, from the date of certification. Accordingly, the PDPA is expected to come into force on a date between September 2023 and March 2025.
You can read the PDPA here.
Send us your Feedback!
Please let us know what you think of DataGuidance! It will only take 60 seconds and help us make the site better for you.
