On October 5, 2024, the Data Protection Authority of Sri Lanka (the Authority) announced that it had launched a public consultation on the draft regulations on the exercise of data subjects' rights and appeals under Sections 17(5), 19(1), and 19(3) of the Personal Data Protection Act No. 9 (PDPA).

The draft regulations prescribe the manner in which data subjects may exercise their rights when they are:

• minors (a person who is under the age of 16 years);
• a person who is physically or mentally unfit;
• deceased and rights are being exercised by their heir; or
• authorizing another person to exercise the said rights on their behalf.

When a data subject is dissatisfied with the decision of the controller in relation to a data subject's request to exercise their rights, the data subject may prefer an appeal to the Authority against the decision of the controller, as per the PDPA. Accordingly, the draft regulations prescribe the form, manner, and time periods relating to appeals a data subject may make to the Authority.

Moreover, an appeal form is provided in the draft regulations, which must be submitted to the Authority either by registered post or through any electronic means specified by the Authority.

Public comments may be submitted to [email protected] by completing the feedback form until November 15, 2024.

You can read the press release here, the draft regulations here, and download the feedback form here.