Law note · Sri Lanka

Personal Data Protection Act, data subject rights

cite Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 stage IN FORCE in force since 2025-03-18 kind Data subject rights binds public and private bodies reviewed 2026-08-29

What it requires

An app must give a data subject in Sri Lanka a way to access, withdraw consent for, rectify, or erase their personal data, including a stored voiceprint or faceprint, and must respond to a written request within one month, extendable by up to two further months with notice; a refusal is appealable to the Data Protection Authority.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

What we found

Data subjects have rights of access (s.13), withdrawal of consent and cessation of further processing (s.14), rectification and completion (s.15), erasure (s.16), and (s.18) review of a decision based solely on automated processing. Section 17, amended in 2025, requires the controller to respond in writing within one month of a written request under ss.13-16 or 18, extendable by up to two further months with notice given before the original month expires.

Section 19, also amended in 2025, gives a right of appeal to the Authority against a controller's refusal on any of these grounds, with the Authority empowered to determine lawfulness and to direct compensation under s.35(2)(c).

Primary source

official statute text, Parliament of Sri Lanka, as amended

← Back to the example · Lint your app →