A. General Inquiries

What we collect: name, email, phone number, and the content of your message.

Why: to read and respond to you.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including promoting data protection compliance and responding to public inquiries.

Retention: 6 months from the date we respond.

Recipients: DPA staff involved in handling the enquiry and, where necessary, service providers or other persons providing specialist assistance.

Is this required?: providing this data is voluntary, but we can't respond to you without your contact details.

B. People who complain to us

(This section describes our intended practice now, and will become the legally binding process once Part II PDPA is in force — see the legal status note above.)

What we collect: your name and contact details, details of the organization you're complaining about, and the content and evidence for your complaint.

Why: to assess and act on your complaint, and to communicate with the organization involved.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including receiving, assessing and handling complaints concerning controllers and processors.

Important - Disclosure to the organization concerned: we may need to disclose your identity and relevant information to the organization concerned so that it can respond to the matters raised. If you have concerns about being identified, please tell us when making your complaint. You may ask us to consider handling your complaint without disclosing your identity — we will consider this request, but withholding your identity may limit our ability to investigate the matter, seek clarification, communicate with you, or provide a fair opportunity for the organization concerned to respond.

Retention: for the duration of the complaint-handling process and for two (2) years following case closure. We may retain records for longer where necessary for a related investigation, enforcement action, appeal, legal claim, audit, systemic-risk analysis, repeat-complaint assessment, statutory recordkeeping or another legal obligation.

Recipients: relevant DPA staff involved in handling the complaint; the organization you are complaining about, where disclosure is necessary to assess or progress the complaint; service providers acting on the DPA’s instructions; professional advisers; courts or tribunals; competent public authorities; and other recipients where disclosure is necessary for complaint handling or required or permitted by law.

Is this required?: providing this data is voluntary, however we cannot investigate a complaint without enough detail to identify what happened and who was involved.

C. Controllers and processors we regulate

Covers organizations and their staff/representatives when we are conducting an inquiry, audit, investigation, or general supervisory correspondence.

What we collect: business and representative contact details, and information relevant to the inquiry or investigation (which may include personal data about your customers or employees where relevant to the matter). This can sometimes include sensitive information — like health, financial, or biometric details — or information about children, if that's part of what we're looking into.

Why: to assess compliance with the PDPA and carry out our statutory enforcement and supervisory functions.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including supervision, inquiries, audits, investigations and enforcement.

Retention: duration of the relevant regulatory activity and for two (2) years following its closure or completion. Where such records relate to an investigation, enforcement action, legal proceedings or other matters requiring extended retention, they may be retained for up to six (6) years following closure, or for such longer period as required or permitted by applicable law. These periods are subject to applicable statutory recordkeeping, archival, audit, appeal, review and legal-hold requirements.

Recipients: relevant DPA staff; service providers acting on the DPA’s instructions; professional advisers; courts or tribunals; competent domestic authorities; and other recipients where disclosure is necessary for supervision, investigation, enforcement, legal proceedings, transparency, or required or permitted by law. We may publish anonymized or aggregated information, including enforcement statistics and decision summaries. Where authorized or required by law, we may also publish regulatory decisions, notices, sanctions or other outcomes, subject to applicable confidentiality, fairness and redaction requirements.

The DPA may receive confidential business information and personal data during supervision, audits, inquiries and investigations. We handle such information in accordance with applicable confidentiality obligations, statutory powers, procedural fairness requirements and any lawful transparency or publication duties. We may share information with overseas regulators or international bodies only where authorized or required by applicable law and subject to appropriate safeguards.

Is this required?: from 1 January 2027, once Part III is in force, providing data pursuant to a statutory information-gathering power will be a legal requirement and failing to do so may itself constitute non-compliance under the PDPA; until then, and for informal requests as part of routine supervision, it's voluntary but helps us close the matter faster.

Where we obtain personal data indirectly: Where we obtain personal data about you from another source, we will provide information about the source, where required by Schedule V, subject to applicable exemptions.

D. Controllers and processors reporting a breach

What we collect: the reporting representative's name and contact details, and details of the breach itself. This may include personal data about affected individuals — including sensitive details like health or financial information, if that's what the breach involved.

Why: to record, assess, and decide what action (if any) to take on the breach. We may use breach-report information for case handling, regulatory oversight, enforcement, and anonymized or aggregated regulatory learning and statistics, subject to applicable law. We may request further information from the reporting organization where necessary to assess the breach.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including receiving, assessing and following up on personal data breach reports.

Retention: for the duration of case handling and for two (2) years following case closure. Records may be retained for longer where necessary for regulatory oversight, enforcement, legal proceedings, audit, accountability, statutory recordkeeping or another legal obligation.

Recipients: relevant DPA staff involved in assessing and managing the breach; service providers acting on the DPA’s instructions; professional advisers; courts or tribunals; competent authorities; and other recipients where disclosure is necessary for breach assessment, follow-up, enforcement, regulatory cooperation, or required or permitted by law.

Is this required?: from 1 January 2027, submitting this data will be a statutory requirement for the reporting controller under Part III; until then, it's voluntary.

E. Registration and licensing applicants

Applies to organisations (e.g. identity management service providers) applying for a license or registration with the DPA, and their nominated contacts.

What we collect: applicant and representative details, and supporting documentation required for the application/licensing process.

Why: to assess and process the application, and to maintain any public or internal register required by the PDPA.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including registration, licensing and maintenance of any register required by law.

Retention: Application records are retained for the duration of the application process and for two (2) years following withdrawal or rejection. Records relating to an approved registration or licence are retained for the duration of the registration or licence and for two (2) years following its expiry or cancellation, unless a longer period is required by law. These periods are subject to applicable statutory recordkeeping, archival, audit, appeal, review and legal-hold requirements.

Recipients: relevant DPA staff, service providers acting on the DPA’s instructions, professional advisers, and other recipients where disclosure is required or permitted by law. Where the PDPA requires a public register of licensed or registered entities, the DPA may publish the name of the entity and any other information required by law. Personal contact details will not ordinarily be published unless publication is required by law or necessary for the register’s purpose.

Is this required?: providing this data is a requirement of the registration/licensing process — without it, we cannot assess or grant the application.

F. Consultation respondents

Applies when you respond to a DPA public consultation, such as a draft directive or draft regulation.

What we collect: your name, contact details, and your feedback/comments.

Why: to consider your input in refining the relevant draft directive or regulation.

Important - Published consultation responses: Where we publish consultation responses or submissions, we will take appropriate steps to avoid unnecessarily publishing your personal contact information. Your name or organization may be published where this is appropriate and permitted by law.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including consultation, policy development, advisory work and rule-making.

Retention: identifiable contact details are retained for six (6) months from our last contact with you, unless a longer period is necessary for the consultation process, follow-up, legal challenge, audit, accountability, statutory recordkeeping or another legal obligation. Consultation submissions and related records may be retained for longer where necessary to document and support the consultation, policy-development or rule-making process.

Recipients: relevant DPA staff; service providers acting on the DPA’s instructions; professional advisers; courts or tribunals; competent authorities; and other recipients where disclosure is required or permitted by law. We may publish consultation submissions, or extracts from them, in accordance with the consultation process and applicable law. We will seek to avoid publishing personal contact details unless this is necessary or required by law.

Is this required?: entirely voluntary — you can respond to a consultation without giving us your name, though we may not be able to follow up on your specific point if you do so anonymously.

G. Job applicants, staff, and Board members

What we collect: CV/application details, references, and (for staff/Board members) employment and governance-related records.

Why: to assess applications, and to administer employment or Board appointments.

Legal basis: Depending on the processing activity, processing is necessary to take steps at your request before entering into an employment or appointment arrangement, to perform an employment or appointment arrangement, to comply with legal obligations, or to carry out functions or duties conferred on the DPA by law.

Retention:

• Job applicants: Unsuccessful applications are retained for twelve (12) months after the recruitment process concludes, subject to applicable legal and regulatory requirements.
• Staff: Staff records are retained for the duration of employment and generally for six (6) years following the end of employment, subject to applicable legal and regulatory requirements.
• Board members: Board member records are retained for the duration of the appointment and for six (6) years following the end of the appointment, subject to applicable legal and regulatory requirements.

Recipients: relevant DPA staff; referees you name; service providers supporting recruitment, HR, payroll, pension, tax, EPF, ETF, insurance, IT, records management or other employment and governance functions, where applicable; professional advisers; and statutory bodies, courts, tribunals or other authorities where required or permitted by law.

Is this required?: providing this data is necessary to consider your application or administer your employment/appointment — without it, we can't proceed.

H. Website visitors and subscribers

What we collect: Name, email address and mobile number when you contact us through our website; and IP address and browser/device information when you visit our website.

Why: To maintain website security and functionality and to respond to enquiries or provide information you have requested.

Legal basis: Our legitimate interests in maintaining a secure and functional website and responding to enquiries.

Retention: IP addresses are retained for no longer than three (3) months for website security purposes. Information provided through our contact form is retained for six (6) months after we respond to your enquiry.

Recipients: Our website hosting and maintenance providers, acting only on our instructions and subject to appropriate confidentiality and data protection obligations.

Is this required?: You can browse our website without providing personal information. Providing your name, email address and mobile number through the contact form is optional, but these details are necessary for us to respond to your enquiry.

I. Event and workshop attendees

What we collect: Name, organization, job title/designation, email address, mobile number, attendance details, and any information you provide when registering for or participating in our events and workshops.

Important - Photographs and recordings: We may take photographs or video recordings at our events and workshops for institutional, educational, awareness and communication purposes. We will provide appropriate notice and, where required by law, obtain consent or rely on another applicable legal basis.

Why: To register and manage your participation, communicate event-related information, manage attendance, issue participation certificates where applicable, and improve our events and workshops.

Legal basis: necessary to administer your participation in the event or workshop and, where applicable, for the performance of functions conferred on the DPA under the PDPA and other applicable law, including stakeholder engagement, awareness-raising and capacity-building activities.

Retention: Event registration and attendance records are retained for two (2) years after the event or workshop, unless a longer period is required for legal, regulatory, audit or accountability purposes. Photographs and recordings are retained for as long as necessary for institutional, educational, awareness and communication purposes, subject to periodic review and any applicable archival, legal, audit or accountability requirements.

Recipients: Event management, registration, venue, IT and other service providers where necessary to organize the event, acting only on our instructions and subject to appropriate data protection obligations.

Is this required?: Providing the information required for registration is necessary to participate in the event or workshop. Participation is otherwise voluntary. Photography and video recordings are not required for participation. Where photographs or recordings are taken for communication or awareness purposes, you will be informed and, where required, asked for your consent.

J. Media and press contacts

What we collect: Name, media outlet/organization and contact details.

Why: to respond to press enquiries and manage communications with the media.

Legal basis: necessary for the performance of functions conferred on the DPA under the PDPA and other applicable law, including public communications and engagement with the media.

Retention: media-contact records are retained for as long as necessary to respond to enquiries and manage the relevant media relationship, subject to periodic review and applicable records-management, legal, audit and accountability requirements.

Recipients: DPA staff responsible for communications and service providers supporting our communications and IT systems, where necessary.

Is this required?: Voluntary - provided so that we can respond to your enquiry or communicate with you about media matters.

K. Right to Information requests

What we collect: requester details and the content of the request, as required under the Right to Information Act.

Why: to process and respond to your request in line with statutory timelines.

Legal basis: necessary for compliance with the Right to Information Act No. 12 of 2016 and for the performance of related statutory functions.

Retention: RTI request records are retained for as long as necessary to process and respond to the request and any related appeal or review, and in accordance with applicable records-management, legal, regulatory and accountability requirements. RTI records may be retained for longer where necessary for an appeal, review, legal claim, audit, statutory recordkeeping or archival requirement.

Recipients: relevant DPA staff and records custodians; persons consulted as part of the RTI process where applicable; professional advisers; the RTI Commission; courts or tribunals; and other recipients where disclosure is required or permitted by the Right to Information Act or other applicable law.

Is this required?: you may need to provide sufficient contact or identifying information for us to process, clarify, authenticate and respond to your request in accordance with the Right to Information Act and applicable procedures.

L. Complaining about us

If you are unhappy with how the DPA has handled your personal data, you may contact our Data Protection Officer at dpo@dpa.gov.lk in the first instance and request an internal review. Where reasonably practicable, the review will be conducted by a person not involved in the original handling of your personal data. We will respond in accordance with our applicable procedures and any statutory timeframe once in force.

If you remain dissatisfied with how we have handled your personal data, you may pursue any applicable independent review, appeal or other legal remedy available under Sri Lankan law. We will update this section to identify the applicable independent review or external remedy route once the relevant PDPA provisions and related procedures are operational.