Sri Lanka’s Personal Data Protection Act (2022)

Right to Access : Data subjects have the right to request access to all the data that has been collected on them by a data controller/processor.

Right of Withdrawal of Consent : Data subjects have the right to withdraw given consent to data collection at any time upon a written request. Moreover, every data subject shall have the right to request a controller in writing, to refrain from further processing of personal data relating to such data subject, in this case.

Right to Rectification : Data subjects have the right to request rectification of data collected on them if it is outdated, incorrect, or obsolete and the controller is to rectify or complete the personal data without undue delayHowever there lies an exception whereby when a controller is required to maintain personal data for the evidentiary purposes under any written law or on an order of a competent court, the controller shall refrain from further processing such personal data without rectifying.

Right to Erasure : All data subjects have the right to request that all data collected on them by a data controller/processor be erased under the circumstances where the processing of personal data is carried out in contravention of the obligations referred to in the law, or when the data subject withdraws their consent upon which processing is based, or the requirement to erase personal data is required by any written law or on an order of a competent court to which the data subject or controller is subject to.Once this request is made, the data controller/processor cannot continue processing any data on the data subject.

Right to Appeal : All data subjects have the availability of the right of appeal to their request of rectification, completion, erasure or refrain from further proceeding, in respect of the refusal by the controller to grant such request.

Right of Appeal to the Authority : Data subjects have a right to appeal to the Data Protection Authority against a controller’s decision of refusal, to rectify, complete, erase, review its decision based solely on automated processing or has not refrained from further processing of personal data. Moreover, any data subject or controller aggrieved by the decision of the Authority, may prefer an appeal to the Court of Appeal not later than thirty days from the date of such decision.

Right to Object to Automated Decision Making : Data subjects have the right to inform the data controller/processor of their objection to automated processing and decision-making that is likely to create an irreversible and continuous impact on their rights and freedoms.

However, it is to be noted that the the controller may, refuse to act on a data subject request made under this Act, in case of

• the national security;
• public order;
• any inquiry conducted, investigation or procedure carried out under any written law;
• the prevention, detection, investigation or prosecution of criminal offences;
• the rights and freedoms of other persons under any written law;
• the technical and operational feasibility of the controller to act on such request;
• the inability of the controller to establish the identity of the data subject;
• the requirement to process personal data under any written law.