The Personal Data Protection Act of Sri Lanka was passed in parliament and was certified by the Speaker on 19th March 2022 and is the principal legislation that deals with the protection of personal data in Sri Lanka. For the large part the Act being in line with global legislation to include the GDPR, filling a long-felt lacuna in the area of information privacy in Sri Lanka.
The Act being brought into force, has however a phased - out application (as detailed in this writing) providing for a cooling off period for relevant parties to have the necessary processes, controls in place and also have carried out the required training for personnel who would be involved in the process.
The fundamental provisions being the protection of personal data by specifying the rights of the data subjects, the obligations of the Controller and Processors, the instances in which the processing of personal data becomes lawful, the manner in which personal data should be processed, provisions with regard to cross border data transfers and the definitions of the key legal terms used in the Act.
Furthermore, the Act establishes a data protection regulator named the Data Protection Authority (the “Authority”) empowered to inter-alia act on complaints received or on its motion and make directives to Controllers and Processors including the right to impose penalties for non-compliance. A right of appeal from the decisions of the Authority lies to the Court of Appeal which may affirm or revise the decisions of the Authority.
The phased-out application will bring into force Parts I-III, to wit; Processing of Data, Rights of Data Subjects and Controllers and Processors on a date not earlier than 18 months and not later than 36 months from the date of the certificate of the Speaker. Part IV - Use of Personal Data to Disseminate Solicited Messages on a date not earlier than 24 months and not later than 48 months from the date of the certificate of the Speaker; with Part V – The Data Protection Authority on a date not later than the date appointed by the Minister for the coming into operation of all other Parts.
LEGAL INSIGHTS
The Personal Data Protection Act
Recommended Insights
Employment act of Sri Lanka: Key Features & Impacts on Labour laws
The proposed new ‘Employment Act’ - The Labor laws of Sri Lanka being promulgated over the years to meet the evolving needs of industrial relations and contained in several different pieces of legislation. In the recent unprecedented times such as the Covid-19 pandemic, the economic and political crisis and Sri Lanka’s current trajectory to an economic recovery, the framework of law was challenged to bring within its scope the many new situations and circumstances requiring regulation. In this
Domestic Violence Part II
‘A woman, a dog, and a walnut tree, the more you beat ’em, the better they be’ - The Sri Lankan legal framework for prevention of domestic violence and abuse, a crisis in the age of the pandemic: The Legal framework in Sri Lanka for the prevention of and punishment for acts of domestic violence is, mainly found within the Penal Code Ordinance No. 2 of 1883 (the ‘PC’), the Code Criminal Procedure Act No. 15 of 1979 (referred to as the ‘CPC’) and the Prevention of Domestic Violence Act No. 34 of
Domestic Violence
A woman, a dog, and a walnut tree, the more you beat ’em, the better they be’ - The Sri Lankan legal framework for prevention of domestic violence and abuse, a crisis in the age of the pandemic: The United Nations provides that - ‘Domestic abuse or "domestic violence" or "intimate partner violence" can be defined as a pattern of behavior in any relationship that is used to gain or maintain power and control over an intimate partner. Abuse constitutes physical, sexual, emotional, economic or psy
Stay informed on legal shifts.
Discuss how these jurisdictional shifts impact your specific operations.