Sri Lanka Personal Data Protection Act (No. 9 of 2022)
Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025: lawful processing conditions and schedules, processing principles, the Data Protection Management Programme, data subject rights with one-month response times, DPOs, processors, breach notification, impact assessments, instrument-based cross-border transfers, consent for promotional messages, and the Data Protection Authority's powers and penalties. Commencement is staged: the Authority has operated since 2023, while the substantive Parts await or have recently received appointed dates. 37 leaves read against the official English texts.
Sri Lanka Personal Data Protection Act (No. 9 of 2022) is a compliance framework from Sri Lanka with 6 domains and 37 controls. The largest domains are Part I: Processing of personal data – Sri Lanka Personal Data Protection Act (No. 9 of 2022) (12 controls), Part III: Controllers and processors – Sri Lanka Personal Data Protection Act (No. 9 of 2022) (10 controls), Part II: Rights of data subjects – Sri Lanka Personal Data Protection Act (No. 9 of 2022) (9 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Application of the Act (section 2) – Sri Lanka Personal Data Protection Act (No. 9 of 2022)
| Code | Title |
|---|---|
| sri-lanka-personal-data-protection-act-no-9-of-2022::s2 | Section 2: Territorial and extraterritorial application |
Part I: Processing of personal data – Sri Lanka Personal Data Protection Act (No. 9 of 2022)
| Code | Title |
|---|---|
| sri-lanka-personal-data-protection-act-no-9-of-2022::s10 | Section 10: Integrity and confidentiality through security measures |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s11 | Section 11 and Schedule V: Transparency information at collection |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s11-SchV-indirect | Schedule V items 4 to 6: Notice when data is not obtained from the data subject |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s12 | Section 12: Data Protection Management Programme |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s5 | Section 5 and Schedule I: Lawful basis for processing |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s5-SchII | Section 5 and Schedule II: Conditions for special categories of personal data |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s5-SchIII | Section 5 and Schedule III: Conditions for valid consent |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s5-SchIV | Section 5 and Schedule IV: Processing for criminal investigations |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s6 | Section 6: Specified, explicit and legitimate purposes |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s7 | Section 7: Adequate, relevant and proportionate data |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s8 | Section 8: Accuracy and currency |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s9 | Section 9: Retention limited to purpose |
Part II: Rights of data subjects – Sri Lanka Personal Data Protection Act (No. 9 of 2022)
| Code | Title |
|---|---|
| sri-lanka-personal-data-protection-act-no-9-of-2022::s13 | Section 13: Right of access |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s14 | Section 14: Withdrawal of consent and objection |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s15 | Section 15: Rectification and completion |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s16 | Section 16: Erasure |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s17-1 | Section 17(1) to (1C) as amended 2025: Time limits and decisions on requests |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s17-2 | Section 17(2) to (4): Grounds for refusal, refusal records and identity checks |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s17-5 | Section 17(5) to (7) as amended 2025: Representatives and no fee |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s18 | Section 18: Review of solely automated decisions |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s19 | Section 19 as amended 2025: Appeals to the Authority and compliance with determinations |
Part III: Controllers and processors – Sri Lanka Personal Data Protection Act (No. 9 of 2022)
| Code | Title |
|---|---|
| sri-lanka-personal-data-protection-act-no-9-of-2022::s20-1 | Section 20(1) as amended 2025: When a Data Protection Officer is required |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s20-2 | Section 20(2) to (4): DPO qualifications, shared DPOs and published contacts |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s20-5 | Section 20(5) as amended 2025: DPO responsibilities |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s21 | Section 21: Choosing processors and joint controllers |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s22 | Section 22: Processor obligations and sub-processors |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s23 | Section 23: Personal data breach notification |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s24 | Section 24 as amended 2025: Personal data protection impact assessment |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s25 | Section 25 as amended 2025: Mitigating risk of harm and mandatory consultation |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s26 | Section 26 as replaced 2025: Cross-border data flows |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s26-3 | Section 26(3) to (5) as replaced 2025: Transfer derogations and public authority limits |
Part IV: Use of personal data to disseminate solicited messages – Sri Lanka Personal Data Protection Act (No. 9 of 2022)
| Code | Title |
|---|---|
| sri-lanka-personal-data-protection-act-no-9-of-2022::s27 | Section 27(1) to (2): Consent before sending solicited messages |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s27-3 | Section 27(3) to (5): Opt-out, sender identity and message codes |
Parts V and VII: The Authority's powers and penalties – Sri Lanka Personal Data Protection Act (No. 9 of 2022)
| Code | Title |
|---|---|
| sri-lanka-personal-data-protection-act-no-9-of-2022::s32 | Sections 32, 33 and 35: Cooperation with the Authority and compliance with directives |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s34 | Section 34: Licences for identity management services |
| sri-lanka-personal-data-protection-act-no-9-of-2022::s38 | Sections 38 and 39: Penalties for failing to comply with directives |
What is Sri Lanka Personal Data Protection Act (No. 9 of 2022) and who does it apply to?
Sri Lanka Personal Data Protection Act (No. 9 of 2022) is a compliance framework from Sri Lanka with 6 domains and 37 controls. Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025: lawful processing conditions and schedules, processing principles, the Data Protection Management Programme, data subject rights with one-month response times, DPOs, processors, breach notification, impact assessments, instrument-based cross-border transfers, consent for promotional messages, and the Data Protection Authority's powers and penalties. Commencement is staged: the Authority has operated since 2023, while the substantive Parts await or have recently received appointed dates. 37 leaves read against the official English texts. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Sri Lanka Personal Data Protection Act (No. 9 of 2022) actually require?
Sri Lanka Personal Data Protection Act (No. 9 of 2022) has 37 controls organised across 6 domains. The largest domains are Part I: Processing of personal data – Sri Lanka Personal Data Protection Act (No. 9 of 2022) (12 controls), Part III: Controllers and processors – Sri Lanka Personal Data Protection Act (No. 9 of 2022) (10 controls), Part II: Rights of data subjects – Sri Lanka Personal Data Protection Act (No. 9 of 2022) (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Sri Lanka Personal Data Protection Act (No. 9 of 2022) do I already cover?
Sri Lanka Personal Data Protection Act (No. 9 of 2022) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Sri Lanka Personal Data Protection Act (No. 9 of 2022)?
Start your Sri Lanka Personal Data Protection Act (No. 9 of 2022) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Sri Lanka Personal Data Protection Act (No. 9 of 2022) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 37 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,016 frameworks.
Get Started Free →Free forever — no credit card required