← Global Privacy Laws Research Library
Act No. 22 of 2025
Sri Lanka Personal Data Protection (Amendment) Act, No. 22 of 2025
Prepared by Shubhank Suman · Last reviewed
Status not verified: principal-law operation depends on Gazette orders
- Legal character
- Amendment Act
- Region
- Asia-Pacific
- Published
- 31 October 2025
What it covers
Amendments to commencement, management programmes, rights-request decisions, automated decisions, restrictions, officers, risk assessments, consultation, international data flow, Authority guidelines, delegated powers, definitions and Schedule VI.
Why it matters
Prevents reliance on superseded wording in the original 2022 attachment. This amendment supplies changes, not the full principal Act or all commencement orders.
Refer to it when
Determine which 2022 provisions changed, how commencement is appointed, updated rights procedures and cross-border safeguards.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
Changes automated-decision review and risk governance in a privacy statute.
Privacy
VERY HIGH
Updates the national personal-data framework.
Cybersecurity
HIGH
Risk assessment and operational safeguards must be read with the principal Act.
Applicability
Amends Act 9/2022; the principal Act’s application, exceptions and remaining provisions still apply. Section 26’s prescribed public-authority restrictions are not a blanket localisation requirement for all controllers.
Read first
Section 2 → sections 3-7 with principal rights → sections 8-10 with principal risk/transfer duties → 11-15.
Provisions / sections covered
Section 2 - Commencement
Replaces principal section 1(3): all provisions except section 1 operate on date(s) appointed by Ministerial Gazette order; removes former subsections (4)-(5) and validates specified prior acts. Does not itself appoint those dates.
Sections 3-7 - Programmes and rights
Changes principal sections 12 and 17-20, including request decisions, automated-decision review, restrictions and officers.
Sections 8-10 - Assessments and data flows
Changes sections 24-25 and replaces section 26. Data flows use compliance duties and Authority-specified instruments with enforceable recipient safeguards; listed alternatives include risk-informed explicit consent and necessity grounds. Public-authority category restrictions remain possible.
Sections 11-15 - Powers and definitions
Adds section 51A guidelines; changes sections 52, 53, 56 and Schedule VI. Read each substituted definition rather than applying old terminology unchanged.
Section 16 - Language priority
Sinhala text prevails in the event of inconsistency between Sinhala and Tamil texts as specified by this Act.
Subject-matter tags
- Consent
- Automated decision-making
- Cross-border transfers
- Data localisation
- Controller and processor
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.