PDPA Compliance Checklist for Employers (Sri Lanka)

The 10-point summary checklist

1. Complete personal data mapping – Owner: HR and Legal – Due: Immediate
2. Document lawful basis per processing activity – Owner: Legal – Due: Immediate
3. Issue updated employee privacy notice – Owner: HR – Due: Immediate
4. Update website privacy policy and client notices – Owner: Marketing and Legal – Due: Immediate
5. Confirm Data Processing Agreements across all processors – Owner: Legal and IT – Due: Within 30 days
6. Enforce role-based access controls – Owner: IT – Due: Within 30 days
7. Assign Data Protection Officer accountability – Owner: Board and senior management – Due: Immediate
8. Finalise breach response playbooks and templates – Owner: Legal – Due: Within 30 days
9. Document retention windows and delete overdue records – Owner: HR and IT – Due: Within 60 days
10. Re-validate biometric processing legal basis – Owner: Legal – Due: Immediate

Data mapping: know what you hold

Before any other compliance work, create a documented inventory of personal data processed by the business.

For each category, document what data is held, where stored, why processed (lawful basis), retention period, who can access it, and whether shared with third parties.

• Employee identity data: recruitment records, HR files, NIC copies
• Payroll and financial data: bank accounts, salary records, EPF/ETF records
• Health and biometric data: medical certificates, leave documentation, attendance biometrics
• Performance data: appraisals, disciplinary records, termination correspondence
• Client contact data: CRM records, service delivery records, invoicing systems
• Vendor and supplier data: contractor agreements and payment records

Lawful basis for each processing activity

• Consent – weakest basis for employer-employee processing due to power imbalance
• Contract – strongest for routine employment data processing
• Legal obligation – applies to tax, EPF/ETF, and statutory reporting
• Vital interests – rare, typically health emergencies
• Legitimate interests – requires balancing test documentation

Employee data handling controls

• Document legal basis for biometric processing (fingerprint, facial recognition)
• Review role-based access and set a review cadence
• Confirm CCTV signage and monitoring disclosures are in place
• Maintain handbook-level policy coverage for workplace monitoring
• Ensure payroll, disciplinary, and medical records are role-restricted

Breach response: the 72-hour window

A risk-bearing breach can require notification to the PDPA Authority within 72 hours of awareness. Failure to notify can trigger a penalty of up to LKR 10,000,000.

• Name a Data Protection Officer or accountable equivalent
• Maintain an incident log template
• Pre-draft regulator and data-subject notification templates
• Define internal escalation and decision flow
• Link breach playbooks to business continuity procedures

Retention benchmarks