🇱🇰
Sri Lanka
Personal Data Protection Act (PDPA)
Asia🟡 Moderate
Compliance Score
36%
5 Addressed
6 Partial
3 None
Authority
Data Protection Authority (DPA)
Overview
Sri Lanka's PDPA, effective 2022, establishes a moderate framework for data protection. The law creates a Data Protection Authority and provides rights to data subjects.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
PartialBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
NoneCookie/Tracking
NoneAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
PartialGovernment Data
Addressed? Frequently Asked Questions
What is the primary data protection law in Sri Lanka?+
Sri Lanka is governed by the Personal Data Protection Act (PDPA). The law is enforced by the Data Protection Authority (DPA). According to our analysis, the country has a Moderate level of data protection framework.
Does Sri Lanka require a Data Protection Officer (DPO)?+
Partially. The Personal Data Protection Act (PDPA) may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Sri Lanka?+
Partially. While Personal Data Protection Act (PDPA) may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Sri Lanka?+
The Personal Data Protection Act (PDPA) has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.