Compliance FrameworksAsia-Pacific
Sri Lanka Personal Data Protection Act No. 9 of 2022
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | LK PDPA |
| Region | Asia-Pacific |
| Country or scope | Sri Lanka |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers LK PDPA
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
LK-PDPA-12 Data Protection Management Programme | Controllers must implement internal controls and a data protection management programme, which presupposes an accurate inventory of the software systems that process personal data (PDPA No. 9 of 2022, s. 12) | Scan |
LK-PDPA-SEC Security of Processing | Appropriate technical and organisational measures must safeguard the integrity and confidentiality of personal data, evidenced by integrity hashes on the components of processing systems (PDPA No. 9 of 2022, s. 12(1) security safeguards) | Scan |
LK-PDPA-PROC Processor Accountability | Controllers may only engage processors that give sufficient guarantees under a binding agreement, so third-party software components must have identifiable suppliers (PDPA No. 9 of 2022, processor-engagement obligations, Part II) | Scan |
LK-PDPA-BRN Breach Notification Readiness | Controllers must notify the Data Protection Authority of personal data breaches, which requires components to be identifiable (PURL/CPE) so breach impact can be assessed quickly (PDPA No. 9 of 2022, personal data breach notification duty, Part II) | Scan |
LK-PDPA-DOC Demonstrable Documentation | The accountability principle requires controllers to be able to demonstrate compliance, so software records must be traceable documents with an identity and creation timestamp (PDPA No. 9 of 2022, s. 12 accountability duties) | Scan |
Policy templates
All 22 from the standard set, adapted to LK PDPA.