The Personal and Domestic Use Exemption is explicitly incorporated into Sri Lanka's Personal Data Protection Act (PDPA) to limit the scope of the law's applicability.

Text of Relevant Provisions

PDPA № 9 Art.2(3a):

"(3) This Act shall not apply to–(a) any personal data processed purely for personal, domestic or household purposes by an individual; and"

Analysis of Provisions

The Sri Lankan PDPA clearly establishes a personal and domestic use exemption in Article 2(3)(a). This provision explicitly states that the Act does not apply to "any personal data processed purely for personal, domestic or household purposes by an individual". This exemption is designed to exclude certain types of data processing from the scope of the law.

The key elements of this exemption are:

1. "purely" - This term emphasizes that the exemption only applies when the processing is exclusively for personal, domestic, or household purposes. Any mixed-use scenarios where personal data is also processed for other purposes would likely fall outside this exemption.
2. "personal, domestic or household purposes" - These terms define the scope of activities that are exempt. They refer to activities that are part of an individual's private or family life, as opposed to professional or commercial activities.
3. "by an individual" - This specifies that the exemption applies to processing carried out by natural persons, not by organizations or legal entities.

Implications

This exemption has several important implications for the application of Sri Lanka's PDPA:

1. Limited scope: The law does not regulate data processing activities that occur within the private sphere of an individual's life. For example, maintaining a personal address book, storing family photos, or keeping a personal diary would likely fall under this exemption.
2. Protection of privacy: By excluding purely personal or domestic activities, the law respects individuals' right to privacy within their personal sphere.
3. Focus on commercial and professional activities: The exemption allows the law to concentrate on regulating data processing in commercial, professional, and organizational contexts where the risks to data subjects' rights are typically higher.
4. Potential grey areas: There may be situations where it's not immediately clear whether processing falls under this exemption. For instance, if an individual uses social media for both personal and professional purposes, determining whether the exemption applies could be challenging.
5. Burden on businesses: Companies operating in Sri Lanka need to ensure that their data processing activities do not fall under this exemption and thus comply with the PDPA's requirements.
6. Exclusion of certain online activities: While many personal online activities might fall under this exemption, those that involve sharing data publicly or for commercial purposes would likely not be exempt.

It's important to note that this exemption does not provide a blanket exclusion for all personal data processing by individuals. The processing must be "purely" for personal, domestic, or household purposes. Any processing that goes beyond these purposes, even if conducted by an individual, would likely fall within the scope of the PDPA and be subject to its provisions.