The PDPA extends its scope to data controllers and processors who offer goods or services to data subjects in Sri Lanka, even if they are not physically located within the country. This provision is particularly significant as it captures foreign entities that engage with the Sri Lankan market.

The law specifically mentions "offering of goods or services with specific targeting of data subjects in Sri Lanka". This language suggests that the mere accessibility of a website or service from Sri Lanka may not be sufficient to trigger the application of the PDPA. Instead, there must be some level of intentional targeting or focus on the Sri Lankan market.

Importantly, Article 2(2a) grants the Authority the power to determine "the circumstances in which the specific targeting of the data subjects may occur". This provision allows for flexibility in interpreting what constitutes "specific targeting", enabling the Authority to adapt to evolving business practices and technologies.

Implications

The inclusion of this factor in the PDPA has several implications for businesses:

1. Extra-territorial application: Foreign companies offering goods or services to Sri Lankan data subjects may fall under the PDPA's jurisdiction, even if they have no physical presence in Sri Lanka.
2. Need for compliance assessment: Companies operating globally or in the Asian market need to assess whether their activities could be construed as specifically targeting Sri Lankan data subjects.
3. Potential for broad interpretation: The Authority's power to determine what constitutes "specific targeting" means that the scope of application could potentially be quite broad, depending on how this is interpreted in practice.
4. Adaptation of business practices: Companies may need to review and potentially modify their marketing strategies, website localization, and service offerings to ensure compliance or to deliberately avoid targeting the Sri Lankan market if they wish to avoid PDPA obligations.
5. Awaiting further guidance: Businesses may need to wait for the Authority to issue rules or guidance on what constitutes "specific targeting" to fully understand their obligations under the PDPA.