Citizen guide · Sri Lanka PDPA

Understand and use your data protection rights.

A practical, plain-language guide for asking organisations how they use your personal information and for making clear, evidence-based requests.

Explore your rights Make a request

USEFUL TO KNOW

Be specific

State clearly what you want the organisation to do.

Keep evidence

Save copies of your request and all responses.

Protect yourself

Do not include passwords or unnecessary sensitive information.

Expect verification

An organisation may reasonably need to confirm your identity.

IMPORTANT NOTE

This guide is for general information and is not legal advice. Your rights, the organisation’s obligations, applicable exceptions, and the correct process can depend on the circumstances. Use the organisation’s privacy notice and the latest official Data Protection Authority guidance when making a request.

YOUR RIGHTS IN PRACTICE

What you can ask an organisation to do.

Personal-data rights are most useful when you know what to ask for, how to identify yourself safely, and how to keep a clear record of the process.

Know how your data is used

You should receive clear information about who is processing your personal data, why it is being processed, the types of data involved, and other relevant details about that processing.

PDPA rights guide

WHEN THIS MAY HELP

You sign up for a service and want to understand what information is collected, why it is needed, and whether it will be shared.

SAMPLE REQUEST WORDING

“Please provide the privacy notice and explain the purpose, lawful basis, recipients, and retention period for my personal data.”

Request access to your data

You may request confirmation of whether an organisation processes your personal data and ask for access to relevant information or a copy, subject to applicable conditions and exceptions.

PDPA rights guide

WHEN THIS MAY HELP

You want to know what data a company, employer, bank, hospital, school, or online service holds about you.

SAMPLE REQUEST WORDING

“Please confirm whether you process my personal data and provide access to the personal data and related processing information held about me.”

Correct inaccurate information

You may ask an organisation to correct personal data that is inaccurate, incomplete, misleading, or out of date.

PDPA rights guide

WHEN THIS MAY HELP

Your contact details, employment record, customer profile, credit-related information, or account details are incorrect.

SAMPLE REQUEST WORDING

“Please correct the following personal data, which I believe is inaccurate or incomplete: [describe the information and provide the correct details].”

Request deletion or restriction

Depending on the situation and applicable legal requirements, you may ask for personal data to be deleted, stopped from being processed, or otherwise restricted.

PDPA rights guide

WHEN THIS MAY HELP

The information is no longer necessary for the original purpose, consent has been withdrawn, or you believe processing should not continue.

SAMPLE REQUEST WORDING

“Please review whether continued processing of my personal data is necessary and, where applicable, delete or restrict the processing of the following data: [describe].”

Object to certain processing

You may object to particular processing activities in circumstances provided by law, especially where you have a reason connected with your individual situation.

PDPA rights guide

WHEN THIS MAY HELP

You disagree with a particular use of your information, such as a decision, communication, or processing activity that affects you.

SAMPLE REQUEST WORDING

“I object to the processing of my personal data for the following activity: [describe]. Please explain the basis for continued processing and consider my objection.”

MAKE AN EFFECTIVE REQUEST

A five-step approach that creates a clear record.

Identify the organisation

Find the organisation’s privacy notice, Data Protection Officer contact details, customer-service channel, or registered office.

Make a clear request

State your full name, relevant account or reference number, the right you want to exercise, and what you are asking for.

Protect your identity

Provide only the verification information reasonably needed. Do not send passwords, card numbers, or unnecessary sensitive data.

Keep a record

Save your request, any attachments, delivery proof, responses, and follow-up correspondence.

Escalate appropriately

If the issue is unresolved, use the organisation’s complaint process and consider seeking independent advice or contacting the regulator.

IF SOMETHING GOES WRONG

Stay factual, organised, and proportionate.

Follow up with the organisation using the original request reference.

Ask for an explanation if your request is refused, limited, delayed, or misunderstood.

Use the organisation’s complaint or escalation channel where available.

Keep all correspondence, dates, names, and supporting documents together.

Consider independent legal advice or regulator guidance for complex or serious matters.

FOR ORGANISATIONS

Need to build a rights-request process?

If your organisation needs help with privacy notices, rights workflows, verification, data retrieval, deletion capability, request registers, and staff training, start with the readiness assessment and implementation checklist.

Take assessment Open checklist

MORE PDPA RESOURCES

Continue learning about privacy and responsible data handling.

Explore the legal library, implementation resources, assessment, and practical guides for organisations and citizens.

Browse resources Legal library