← Global Privacy Laws Research Library
Act No. 9 of 2022
Sri Lanka Personal Data Protection Act, No. 9 of 2022
Prepared by Shubhank Suman · Last reviewed
Status not verified: read with Act 22/2025 and relevant Gazette orders
- Legal character
- National statute
- Region
- Asia-Pacific
- Published
- 25 March 2022
What it covers
Lawful personal-data processing, purpose and proportionality, accuracy, retention, integrity/confidentiality, transparency, management programmes, rights, automated decisions, officers, processors, breaches, risk assessments, transfers and enforcement.
Why it matters
The original Act remains necessary for the provisions not replaced by the 2025 amendment, but its original commencement and cross-border text must not be presented as the amended law.
Refer to it when
Research Sri Lankan processing, rights, automated decisions, security, DPIAs, overseas data flows or Authority powers; read the linked amendment alongside it.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
Automated-decision review and high-risk technology assessments; not a general AI framework.
Privacy
VERY HIGH
General principles, rights and accountability.
Cybersecurity
HIGH
Security, processor controls and breach procedures.
Applicability
Section 2 territorial/offering/monitoring tests, domestic-use exclusion and applicable exceptions; schedules and controller/processor roles must be considered separately.
Read first
Act 22/2025 section 2 → Act 9/2022 sections 2-12 → amended 17-20 and 24-26 → section 23 → Authority provisions.
Provisions / sections covered
Sections 1-3 - Commencement and application
Section 2 includes processing wholly/partly in Sri Lanka and specified foreign establishment, offering and monitoring connections; individual domestic/household processing is excluded. Original section 1 commencement is replaced by the 2025 amendment.
Sections 4-12 and Schedules - Principles
Lawfulness and conditions, purpose, proportionality, accuracy, retention, security, transparency and management programmes; the amendment removes section 12(2).
Sections 13-20 - Rights and decisions
Access, objection/withdrawal, rectification, erasure, request decisions and automated-decision review. Sections 17-20 have material amendments and must be read in updated form.
Sections 21-26 - Operational safeguards
Processor duties, records, section 23 breaches, DPIAs and prior consultation. Section 23 delegates timing to Authority rules; no universal 72-hour deadline is asserted. Sections 24-26 are changed by Act 22/2025.
Sections 28 onward - Authority and enforcement
Authority governance, investigation, directives, penalties, appeals, exceptions and delegated rules; read new section 51A in the amendment too.
Subject-matter tags
- Erasure and deletion
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Retention
- Enforcement and penalties
- Surveillance
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.