The Act covers processing that happens wholly or partly in Sri Lanka, and processing by a controller or processor that is domiciled or ordinarily resident in Sri Lanka, is incorporated or established under Sri Lankan law, offers goods or services to (including specifically targets) data subjects in Sri Lanka, or specifically monitors their behaviour there, including profiling to make decisions about them; the Authority may set by rules when targeting or monitoring occurs. Purely personal or household processing and non-personal data are outside it. Appointed to come into operation on 1 January 2027 (see the status introduction).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.