At D. L. & F. De Saram, we advise organisations on how to collect, use, share and protect personal data in a way that meets legal requirements and earns the trust of customers, employees and business partners. Data protection is no longer a concern only for technology companies; banks, hospitals, retailers, manufacturers, hotels, educational institutions and public bodies all process personal data as part of their everyday operations.
Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 sets out a framework of obligations for organisations that process personal data, alongside rights for the individuals whose data is processed. Many organisations operating in Sri Lanka also need to consider overseas data protection laws that apply to their business, their group companies or their customers.
We help clients understand what the law requires of them in practice and build compliance into their operations in a proportionate and workable way.
Our Expertise in Data Protection & Privacy
We advise clients in every industry on:
- Designing and implementing data protection compliance programmes, including gap assessments, data mapping and internal policies
- Drafting privacy notices, consent mechanisms and employee privacy documentation
- Data processing agreements between controllers and processors, and data sharing and transfer agreements
- Cross-border transfers of personal data, including intra-group transfers and transfers to overseas service providers
- Preparing for and responding to personal data breaches, including incident response plans, investigations and notifications
- Handling data subject requests, including requests for access, correction and erasure
- Data protection governance, including the role of data protection officers
- Engagement with the Data Protection Authority and with sector regulators
- The data protection aspects of mergers, acquisitions, outsourcing and technology procurement, including due diligence and contractual protections
Our advice is practical and risk-based, recognising that compliance must work within the realities of each organisation’s systems, resources and commercial priorities.
Data Protection Across the Business Lifecycle
Personal data issues arise at many points in an organisation’s life. We support clients:
- When launching new products, apps, websites or customer programmes, by advising on privacy by design and the lawful basis for processing
- When outsourcing functions such as payroll, customer support or IT, by reviewing service provider arrangements and data security obligations
- When marketing to customers, by advising on direct marketing, profiling and consent
- When monitoring employees or introducing new workplace technologies
- When buying, selling or investing in a business, by assessing data protection risk and addressing it in the transaction documents
- When something goes wrong, by coordinating a prompt and measured response to a breach or complaint
Data protection often overlaps with technology and digital matters. We work closely with our Technology, Media & Digital practice on software, cloud, e-commerce and digital platform matters, and with our Mergers & Acquisitions team on transaction due diligence.