Material Applicability

The PDPA's material scope is primarily defined through exclusions, with one key factor:

• Personal and Domestic Use Exemption

PDPA № 9 Art.2(3a):

(3) This Act shall not apply to–(a) any personal data processed purely for personal, domestic or household purposes by an individual;

This exemption excludes processing activities conducted by individuals solely for personal or household purposes, ensuring the Act focuses on commercial and professional data processing activities.

Territorial Applicability

The PDPA's territorial scope is determined by five key factors:

• Processing in jurisdiction
• Processing by Entity Registered or Incorporated in Jurisdiction
• Processing by Local Establishment
• Offering Goods and Services to Data Subjects in Jurisdiction
• Monitoring Data Subjects Within Jurisdiction

Processing in Jurisdiction

PDPA № 9 Art.2(1a):

(1) This Act shall apply to the processing of personal data—(a) where the processing of personal data takes place wholly or partly within Sri Lanka; or

The Act applies to all data processing activities occurring within Sri Lankan territory, regardless of the processor's location or establishment.

Entity Registration and Local Establishment

PDPA № 9 Art.2(1b)(i)(ii):

(1) This Act shall apply to the processing of personal data—(b) where the processing of personal data is carried out by a controller or processor who–(i) is domiciled or ordinarily resident in Sri Lanka;(ii) is incorporated or established under any written law of Sri Lanka;

The Act covers processors and controllers who:

• Are domiciled or ordinarily resident in Sri Lanka
• Are incorporated under Sri Lankan law
• Have established operations under Sri Lankan legislation

Offering Goods and Services

PDPA № 9 Art.2(1b)(iii):

(b) where the processing of personal data is carried out by a controller or processor who–(iii) offers goods or services to data subjects in Sri Lanka including the offering of goods or services with specific targeting of data subjects in Sri Lanka;

The Act applies to entities targeting Sri Lankan data subjects with goods or services, regardless of their location. The Authority may further define what constitutes "specific targeting" through rules.

Monitoring Behavior

PDPA № 9 Art.2(1b)(iv):

(b) where the processing of personal data is carried out by a controller or processor who–(iv) specifically monitors the behaviour of data subjects in Sri Lanka including profiling with the intention of making decisions in relation to the behavior of such data subjects in so far as such behaviour takes place in Sri Lanka.

The Act covers entities monitoring or profiling Sri Lankan data subjects' behavior for decision-making purposes, provided such behavior occurs within Sri Lanka.