Law note · Sri Lanka

Personal Data Protection Act, special categories and biometric data

cite Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II stage IN FORCE in force since 2025-03-18 kind Sensitive categories binds public and private bodies reviewed 2026-08-29

What it requires

An app that derives a faceprint, voiceprint, or other biometric identifier used to uniquely identify a person in Sri Lanka must treat it as a special category of personal data and satisfy one of Schedule II's conditions, ordinarily the data subject's consent, before processing it.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Excludes recording-derived identifiers: No

What we found

Biometric data is defined at s.56 as personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm unique identification, including facial images, dactyloscopic (fingerprint) data, or iris-related data. Biometric data used for unique identification is one of the enumerated special categories of personal data.

Schedule II conditions processing of a special category on the data subject's consent (or a parent or guardian's for a child) unless another written law prohibits it regardless of consent, employment or social-security or defined public-health necessity, emergency necessity, data manifestly made public by the data subject, legal-claims necessity, or public interest under a written law with safeguards.

The operative definition's technology-neutral "physical, physiological or behavioral characteristics" language reaches a voice-derived identifier on its own terms, though the illustrative list names only facial images, fingerprint, and iris data, not voice specifically.

Primary source

official statute text, Parliament of Sri Lanka

← Back to the example · Lint your app →