Extracts :

Extract :

"5.1. Consent Pursuant to Section 5 of the PDPA, the processing of personal data is lawful if the data subject has given consent to the processing of their personal data as enumerated in paragraph (a) of Schedule I and paragraph (a) of Schedule II. Consent has been defined as any freely given, specific, informed, and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject's agreement to the processing of their personal data. With regard to the processing of special categories of personal data relating to a child, consent would mean the consent of the parent or legal guardian of such child. The PDPA further provides conditions and obligations on the controller regarding consent in Schedule III. The controller is required to demonstrate that the data subject has consented to the processing of the personal data relating to such data subject. In the event the consent of the data subject is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in such a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. When assessing whether consent is freely given, utmost account shall be taken on whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. 5.2. Contract with the data subject Pursuant to Schedule I(b) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. The PDPA further permits the processing of personal data outside Sri Lanka in the absence of an adequacy decision as mentioned in Section 26(2) of the PDPA or necessary safeguards as mentioned in Section 26(4) of the PDPA where such transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre-contractual measures taken by the controller at the request of the data subject. 5.3. Legal obligations Ordinary types of personal data Pursuant to Schedule I(c) of the PDPA, the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation to which the controller is subject under the PDPA. Special categories of personal data Pursuant to Schedule II(e) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for the establishment, exercise, or defense of legal claims before a court or tribunal or such similar forum or whenever courts are acting in their judicial capacity. 5.4. Interests of the data subject Ordinary types of personal data Pursuant to Schedule I(d) of the PDPA, the processing of personal data is lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person. Special categories of personal data Schedule II(c) of the PDPA provides that with regard to the processing of special categories of data, the processing of such data would be lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent. 5.5. Public interest Ordinary types of personal data Pursuant to Schedule I(e) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by any written law. For the foregoing purposes, Schedule II(g) of the PDPA provides a non-exhaustive list of activities considered as 'public interests,' including: • processing for health purposes such as public health and social protection and the management of health care services; • processing for the control of communicable diseases and other serious threats to health; and • processing of personal data by official authorities for achieving the purposes or objects laid down by law. Special categories of personal data Pursuant to Schedule II(g) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or sta- tistical purposes in accordance with law which shall be proportionate to the aim pursued, protecting the data protection rights enumerated in the PDPA or any other written law and provide for suitable and specific measures to safeguard the rights and freedoms of the data subject. 5.6. Legitimate interests of the data controller Pursuant to Schedule I(f) of the PDPA, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such inter- ests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child. For the foregoing purposes, Schedule I(f) of the PDPA provides a non-exhaustive list of activities considered as 'legitimate interests', including: • processing in situations where the data subject is a client or in the service of the controller; • whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place; • processing of personal data is strictly necessary for the purposes of preventing fraud; and • processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 5.7. Legal bases in other instances In relation to the processing of special categories of personal data, Schedule II of the PDPA sets out additional legal bases. In particular, the processing of such personal data will be lawful if: • processing is necessary for the purposes of carrying out the obligations of the controller and exercising the rights of the data subject, in the field of employment, social security including pension, and for public health purposes ensuring public safety, monitoring, and alert purposes, the prevention or control of communicable diseases, and other serious threats to public health, and the management of public health care services in so far as it is provided for in any written law providing for appropriate safeguards for rights of the data subject; • processing relates to personal data which is manifestly made public by the data subject; • processing is necessary for reasons of substantial public interest, as prescribed by any written law which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject; or • where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment, or the management of health care services, and where such data is pro- cessed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"5.1. Consent Pursuant to Section 5 of the PDPA, the processing of personal data is lawful if the data subject has given consent to the processing of their personal data as enumerated in paragraph (a) of Schedule I and paragraph (a) of Schedule II. Consent has been defined as any freely given, specific, informed, and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject's agreement to the processing of their personal data. With regard to the processing of special categories of personal data relating to a child, consent would mean the consent of the parent or legal guardian of such child. The PDPA further provides conditions and obligations on the controller regarding consent in Schedule III. The controller is required to demonstrate that the data subject has consented to the processing of the personal data relating to such data subject. In the event the consent of the data subject is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in such a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. When assessing whether consent is freely given, utmost account shall be taken on whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. 5.2. Contract with the data subject Pursuant to Schedule I(b) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. The PDPA further permits the processing of personal data outside Sri Lanka in the absence of an adequacy decision as mentioned in Section 26(2) of the PDPA or necessary safeguards as mentioned in Section 26(4) of the PDPA where such transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre-contractual measures taken by the controller at the request of the data subject. 5.3. Legal obligations Ordinary types of personal data Pursuant to Schedule I(c) of the PDPA, the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation to which the controller is subject under the PDPA. Special categories of personal data Pursuant to Schedule II(e) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for the establishment, exercise, or defense of legal claims before a court or tribunal or such similar forum or whenever courts are acting in their judicial capacity. 5.4. Interests of the data subject Ordinary types of personal data Pursuant to Schedule I(d) of the PDPA, the processing of personal data is lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person. Special categories of personal data Schedule II(c) of the PDPA provides that with regard to the processing of special categories of data, the processing of such data would be lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent. 5.5. Public interest Ordinary types of personal data Pursuant to Schedule I(e) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by any written law. For the foregoing purposes, Schedule II(g) of the PDPA provides a non-exhaustive list of activities considered as 'public interests,' including: • processing for health purposes such as public health and social protection and the management of health care services; • processing for the control of communicable diseases and other serious threats to health; and • processing of personal data by official authorities for achieving the purposes or objects laid down by law. Special categories of personal data Pursuant to Schedule II(g) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or sta- tistical purposes in accordance with law which shall be proportionate to the aim pursued, protecting the data protection rights enumerated in the PDPA or any other written law and provide for suitable and specific measures to safeguard the rights and freedoms of the data subject. 5.6. Legitimate interests of the data controller Pursuant to Schedule I(f) of the PDPA, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such inter- ests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child. For the foregoing purposes, Schedule I(f) of the PDPA provides a non-exhaustive list of activities considered as 'legitimate interests', including: • processing in situations where the data subject is a client or in the service of the controller; • whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place; • processing of personal data is strictly necessary for the purposes of preventing fraud; and • processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 5.7. Legal bases in other instances In relation to the processing of special categories of personal data, Schedule II of the PDPA sets out additional legal bases. In particular, the processing of such personal data will be lawful if: • processing is necessary for the purposes of carrying out the obligations of the controller and exercising the rights of the data subject, in the field of employment, social security including pension, and for public health purposes ensuring public safety, monitoring, and alert purposes, the prevention or control of communicable diseases, and other serious threats to public health, and the management of public health care services in so far as it is provided for in any written law providing for appropriate safeguards for rights of the data subject; • processing relates to personal data which is manifestly made public by the data subject; • processing is necessary for reasons of substantial public interest, as prescribed by any written law which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject; or • where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment, or the management of health care services, and where such data is pro- cessed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"5.1. Consent Pursuant to Section 5 of the PDPA, the processing of personal data is lawful if the data subject has given consent to the processing of their personal data as enumerated in paragraph (a) of Schedule I and paragraph (a) of Schedule II. Consent has been defined as any freely given, specific, informed, and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject's agreement to the processing of their personal data. With regard to the processing of special categories of personal data relating to a child, consent would mean the consent of the parent or legal guardian of such child. The PDPA further provides conditions and obligations on the controller regarding consent in Schedule III. The controller is required to demonstrate that the data subject has consented to the processing of the personal data relating to such data subject. In the event the consent of the data subject is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in such a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. When assessing whether consent is freely given, utmost account shall be taken on whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. 5.2. Contract with the data subject Pursuant to Schedule I(b) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. The PDPA further permits the processing of personal data outside Sri Lanka in the absence of an adequacy decision as mentioned in Section 26(2) of the PDPA or necessary safeguards as mentioned in Section 26(4) of the PDPA where such transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre-contractual measures taken by the controller at the request of the data subject. 5.3. Legal obligations Ordinary types of personal data Pursuant to Schedule I(c) of the PDPA, the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation to which the controller is subject under the PDPA. Special categories of personal data Pursuant to Schedule II(e) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for the establishment, exercise, or defense of legal claims before a court or tribunal or such similar forum or whenever courts are acting in their judicial capacity. 5.4. Interests of the data subject Ordinary types of personal data Pursuant to Schedule I(d) of the PDPA, the processing of personal data is lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person. Special categories of personal data Schedule II(c) of the PDPA provides that with regard to the processing of special categories of data, the processing of such data would be lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent. 5.5. Public interest Ordinary types of personal data Pursuant to Schedule I(e) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by any written law. For the foregoing purposes, Schedule II(g) of the PDPA provides a non-exhaustive list of activities considered as 'public interests,' including: • processing for health purposes such as public health and social protection and the management of health care services; • processing for the control of communicable diseases and other serious threats to health; and • processing of personal data by official authorities for achieving the purposes or objects laid down by law. Special categories of personal data Pursuant to Schedule II(g) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or sta- tistical purposes in accordance with law which shall be proportionate to the aim pursued, protecting the data protection rights enumerated in the PDPA or any other written law and provide for suitable and specific measures to safeguard the rights and freedoms of the data subject. 5.6. Legitimate interests of the data controller Pursuant to Schedule I(f) of the PDPA, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such inter- ests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child. For the foregoing purposes, Schedule I(f) of the PDPA provides a non-exhaustive list of activities considered as 'legitimate interests', including: • processing in situations where the data subject is a client or in the service of the controller; • whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place; • processing of personal data is strictly necessary for the purposes of preventing fraud; and • processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 5.7. Legal bases in other instances In relation to the processing of special categories of personal data, Schedule II of the PDPA sets out additional legal bases. In particular, the processing of such personal data will be lawful if: • processing is necessary for the purposes of carrying out the obligations of the controller and exercising the rights of the data subject, in the field of employment, social security including pension, and for public health purposes ensuring public safety, monitoring, and alert purposes, the prevention or control of communicable diseases, and other serious threats to public health, and the management of public health care services in so far as it is provided for in any written law providing for appropriate safeguards for rights of the data subject; • processing relates to personal data which is manifestly made public by the data subject; • processing is necessary for reasons of substantial public interest, as prescribed by any written law which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject; or • where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment, or the management of health care services, and where such data is pro- cessed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"5.1. Consent Pursuant to Section 5 of the PDPA, the processing of personal data is lawful if the data subject has given consent to the processing of their personal data as enumerated in paragraph (a) of Schedule I and paragraph (a) of Schedule II. Consent has been defined as any freely given, specific, informed, and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject's agreement to the processing of their personal data. With regard to the processing of special categories of personal data relating to a child, consent would mean the consent of the parent or legal guardian of such child. The PDPA further provides conditions and obligations on the controller regarding consent in Schedule III. The controller is required to demonstrate that the data subject has consented to the processing of the personal data relating to such data subject. In the event the consent of the data subject is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in such a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. When assessing whether consent is freely given, utmost account shall be taken on whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. 5.2. Contract with the data subject Pursuant to Schedule I(b) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. The PDPA further permits the processing of personal data outside Sri Lanka in the absence of an adequacy decision as mentioned in Section 26(2) of the PDPA or necessary safeguards as mentioned in Section 26(4) of the PDPA where such transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre-contractual measures taken by the controller at the request of the data subject. 5.3. Legal obligations Ordinary types of personal data Pursuant to Schedule I(c) of the PDPA, the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation to which the controller is subject under the PDPA. Special categories of personal data Pursuant to Schedule II(e) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for the establishment, exercise, or defense of legal claims before a court or tribunal or such similar forum or whenever courts are acting in their judicial capacity. 5.4. Interests of the data subject Ordinary types of personal data Pursuant to Schedule I(d) of the PDPA, the processing of personal data is lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person. Special categories of personal data Schedule II(c) of the PDPA provides that with regard to the processing of special categories of data, the processing of such data would be lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent. 5.5. Public interest Ordinary types of personal data Pursuant to Schedule I(e) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by any written law. For the foregoing purposes, Schedule II(g) of the PDPA provides a non-exhaustive list of activities considered as 'public interests,' including: • processing for health purposes such as public health and social protection and the management of health care services; • processing for the control of communicable diseases and other serious threats to health; and • processing of personal data by official authorities for achieving the purposes or objects laid down by law. Special categories of personal data Pursuant to Schedule II(g) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or sta- tistical purposes in accordance with law which shall be proportionate to the aim pursued, protecting the data protection rights enumerated in the PDPA or any other written law and provide for suitable and specific measures to safeguard the rights and freedoms of the data subject. 5.6. Legitimate interests of the data controller Pursuant to Schedule I(f) of the PDPA, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such inter- ests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child. For the foregoing purposes, Schedule I(f) of the PDPA provides a non-exhaustive list of activities considered as 'legitimate interests', including: • processing in situations where the data subject is a client or in the service of the controller; • whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place; • processing of personal data is strictly necessary for the purposes of preventing fraud; and • processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 5.7. Legal bases in other instances In relation to the processing of special categories of personal data, Schedule II of the PDPA sets out additional legal bases. In particular, the processing of such personal data will be lawful if: • processing is necessary for the purposes of carrying out the obligations of the controller and exercising the rights of the data subject, in the field of employment, social security including pension, and for public health purposes ensuring public safety, monitoring, and alert purposes, the prevention or control of communicable diseases, and other serious threats to public health, and the management of public health care services in so far as it is provided for in any written law providing for appropriate safeguards for rights of the data subject; • processing relates to personal data which is manifestly made public by the data subject; • processing is necessary for reasons of substantial public interest, as prescribed by any written law which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject; or • where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment, or the management of health care services, and where such data is pro- cessed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"5.1. Consent Pursuant to Section 5 of the PDPA, the processing of personal data is lawful if the data subject has given consent to the processing of their personal data as enumerated in paragraph (a) of Schedule I and paragraph (a) of Schedule II. Consent has been defined as any freely given, specific, informed, and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject's agreement to the processing of their personal data. With regard to the processing of special categories of personal data relating to a child, consent would mean the consent of the parent or legal guardian of such child. The PDPA further provides conditions and obligations on the controller regarding consent in Schedule III. The controller is required to demonstrate that the data subject has consented to the processing of the personal data relating to such data subject. In the event the consent of the data subject is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in such a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. When assessing whether consent is freely given, utmost account shall be taken on whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. 5.2. Contract with the data subject Pursuant to Schedule I(b) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. The PDPA further permits the processing of personal data outside Sri Lanka in the absence of an adequacy decision as mentioned in Section 26(2) of the PDPA or necessary safeguards as mentioned in Section 26(4) of the PDPA where such transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre-contractual measures taken by the controller at the request of the data subject. 5.3. Legal obligations Ordinary types of personal data Pursuant to Schedule I(c) of the PDPA, the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation to which the controller is subject under the PDPA. Special categories of personal data Pursuant to Schedule II(e) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for the establishment, exercise, or defense of legal claims before a court or tribunal or such similar forum or whenever courts are acting in their judicial capacity. 5.4. Interests of the data subject Ordinary types of personal data Pursuant to Schedule I(d) of the PDPA, the processing of personal data is lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person. Special categories of personal data Schedule II(c) of the PDPA provides that with regard to the processing of special categories of data, the processing of such data would be lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent. 5.5. Public interest Ordinary types of personal data Pursuant to Schedule I(e) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by any written law. For the foregoing purposes, Schedule II(g) of the PDPA provides a non-exhaustive list of activities considered as 'public interests,' including: • processing for health purposes such as public health and social protection and the management of health care services; • processing for the control of communicable diseases and other serious threats to health; and • processing of personal data by official authorities for achieving the purposes or objects laid down by law. Special categories of personal data Pursuant to Schedule II(g) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or sta- tistical purposes in accordance with law which shall be proportionate to the aim pursued, protecting the data protection rights enumerated in the PDPA or any other written law and provide for suitable and specific measures to safeguard the rights and freedoms of the data subject. 5.6. Legitimate interests of the data controller Pursuant to Schedule I(f) of the PDPA, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such inter- ests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child. For the foregoing purposes, Schedule I(f) of the PDPA provides a non-exhaustive list of activities considered as 'legitimate interests', including: • processing in situations where the data subject is a client or in the service of the controller; • whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place; • processing of personal data is strictly necessary for the purposes of preventing fraud; and • processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 5.7. Legal bases in other instances In relation to the processing of special categories of personal data, Schedule II of the PDPA sets out additional legal bases. In particular, the processing of such personal data will be lawful if: • processing is necessary for the purposes of carrying out the obligations of the controller and exercising the rights of the data subject, in the field of employment, social security including pension, and for public health purposes ensuring public safety, monitoring, and alert purposes, the prevention or control of communicable diseases, and other serious threats to public health, and the management of public health care services in so far as it is provided for in any written law providing for appropriate safeguards for rights of the data subject; • processing relates to personal data which is manifestly made public by the data subject; • processing is necessary for reasons of substantial public interest, as prescribed by any written law which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject; or • where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment, or the management of health care services, and where such data is pro- cessed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"5.1. Consent Pursuant to Section 5 of the PDPA, the processing of personal data is lawful if the data subject has given consent to the processing of their personal data as enumerated in paragraph (a) of Schedule I and paragraph (a) of Schedule II. Consent has been defined as any freely given, specific, informed, and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject's agreement to the processing of their personal data. With regard to the processing of special categories of personal data relating to a child, consent would mean the consent of the parent or legal guardian of such child. The PDPA further provides conditions and obligations on the controller regarding consent in Schedule III. The controller is required to demonstrate that the data subject has consented to the processing of the personal data relating to such data subject. In the event the consent of the data subject is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in such a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. When assessing whether consent is freely given, utmost account shall be taken on whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. 5.2. Contract with the data subject Pursuant to Schedule I(b) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. The PDPA further permits the processing of personal data outside Sri Lanka in the absence of an adequacy decision as mentioned in Section 26(2) of the PDPA or necessary safeguards as mentioned in Section 26(4) of the PDPA where such transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre-contractual measures taken by the controller at the request of the data subject. 5.3. Legal obligations Ordinary types of personal data Pursuant to Schedule I(c) of the PDPA, the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation to which the controller is subject under the PDPA. Special categories of personal data Pursuant to Schedule II(e) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for the establishment, exercise, or defense of legal claims before a court or tribunal or such similar forum or whenever courts are acting in their judicial capacity. 5.4. Interests of the data subject Ordinary types of personal data Pursuant to Schedule I(d) of the PDPA, the processing of personal data is lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person. Special categories of personal data Schedule II(c) of the PDPA provides that with regard to the processing of special categories of data, the processing of such data would be lawful if the processing is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent. 5.5. Public interest Ordinary types of personal data Pursuant to Schedule I(e) of the PDPA, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by any written law. For the foregoing purposes, Schedule II(g) of the PDPA provides a non-exhaustive list of activities considered as 'public interests,' including: • processing for health purposes such as public health and social protection and the management of health care services; • processing for the control of communicable diseases and other serious threats to health; and • processing of personal data by official authorities for achieving the purposes or objects laid down by law. Special categories of personal data Pursuant to Schedule II(g) of the PDPA, the processing of special categories of personal data is lawful if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or sta- tistical purposes in accordance with law which shall be proportionate to the aim pursued, protecting the data protection rights enumerated in the PDPA or any other written law and provide for suitable and specific measures to safeguard the rights and freedoms of the data subject. 5.6. Legitimate interests of the data controller Pursuant to Schedule I(f) of the PDPA, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such inter- ests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child. For the foregoing purposes, Schedule I(f) of the PDPA provides a non-exhaustive list of activities considered as 'legitimate interests', including: • processing in situations where the data subject is a client or in the service of the controller; • whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place; • processing of personal data is strictly necessary for the purposes of preventing fraud; and • processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 5.7. Legal bases in other instances In relation to the processing of special categories of personal data, Schedule II of the PDPA sets out additional legal bases. In particular, the processing of such personal data will be lawful if: • processing is necessary for the purposes of carrying out the obligations of the controller and exercising the rights of the data subject, in the field of employment, social security including pension, and for public health purposes ensuring public safety, monitoring, and alert purposes, the prevention or control of communicable diseases, and other serious threats to public health, and the management of public health care services in so far as it is provided for in any written law providing for appropriate safeguards for rights of the data subject; • processing relates to personal data which is manifestly made public by the data subject; • processing is necessary for reasons of substantial public interest, as prescribed by any written law which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject; or • where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment, or the management of health care services, and where such data is pro- cessed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Where on receipt of a complaint or otherwise, and the Authority has reason to believe that any controller is engaged or is about to engage in any processing activity in contravention of the PDPA or has contravened or has failed to comply with the provisions of the PDPA or any rule, regulation, guideline, or order made under the PDPA or any other written law, the Authority may, after giving an opportunity to the controller or processor of being heard, and after such inquiry as the Authority may consider necessary, issue a directive to that controller or processor (Section 35 of the PDPA). A directive may require such entity to: • cease and refrain from engaging in the act, omission, or course of conduct related to processing; • perform such acts as in the opinion of the Authority are necessary to rectify the situation; and • to make a payment of such sum of money as compensation as determined by the Authority to an aggrieved person who has suffered harm, loss, or damage as a result of any contravention by a controller or proces- sor. Section 38 of the PDPA imposes a penalty of up to LKR 10 million (approx. $ 31,099 ) for the failure to comply with a directive issued under the provisions of Section 35 of the PDPA, taking into consideration the nature and ex- tent of non-compliance, as well as its impact on data subjects. Where a controller or processor, who has been subjected to a penalty on a previous occasion, subsequently fails to conform to a directive on any further occa- sion, such person shall in addition to the penalty which may be imposed on them earlier be liable to the payment of an additional penalty consisting of twice the amount imposed as a penalty on the second and for each sub- sequent non-compliance. The PDPA further prescribes a list of matters to consider when imposing a penalty which includes, inter alia: • the nature, gravity, and duration of the contravention; • the degree of responsibility of the controller; • the categories of personal data affected by any contravention; and • any action that was taken by the controller or processor to mitigate the damage suffered by data subjects. In addition, the imposition of a penalty does not preclude the Authority from taking other regulatory measures, including, but not limited to, the suspension of business activities."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

" In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

Extracts :

Extract :

"Section 11 of the PDPA obliges controllers to provide the information referred to in Schedule V of the PDPA and information regarding any decision taken pursuant to a request made under Part II of the PDPA in writing or by electronic means and in a concise, transparent, intelligible, and easily accessible form. In particular, the controller must provide the following information to the data subject at the time of collecting their personal data: • the identity and contact details of the controller and where applicable of the controller's representative; • the contact details of the DPO, where applicable; • the intended purposes for which the personal data is processed and the legal basis for the processing; • the legitimate interest pursued by the controller or by a third party where processing is based on paragraph (f) of Schedule I; • the categories of personal data being collected; • where processing is intended to be based on consent, the existence of the right of the data subject to withdraw their consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; • recipients or third parties with whom such personal data may be shared, if applicable; • information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; • the period for which the personal data shall be retained in terms of Section 9 of the PDPA or where such period is not known, the criteria for determining such period; • the existence of and procedure for the exercise of rights of the data subject mentioned in Part II of the PDPA; • the existence of a right to file complaints to the Authority; • whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and • the existence of automated decision-making, referred to in Section 18 of the PDPA, including profiling and, at least in those cases, reasonably meaningful information about the logic involved, as well as the signifi- cance and the envisaged consequences of such processing for the data subject."

Reference :

Sri Lanka Data protection overview | DataGuidance

Information on Sri Lanka data protection

🇱🇰 Sri Lanka

Data subject classification

Citizens outside their jurisdiction are considered as data subjects :

Persons within their jurisdiction are considered as data subjects :

Legal entities are considered as data subjects :

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : Yes

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : No

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject :

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) :

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : No

Subject private remedies - presence of individual personal actions? : No

Subject private remedies - representative actions? : No

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Audit or supervise Data Processors :

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : No

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : No

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : No

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : No

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing :

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : No