The PDPA requires controllers and processors which are not public authorities to appoint a Data Protection Officer (“DPO”) where their core activities consist of:

1. processing operations that require regular and systematic monitoring of data subjects on a prescribed scale or magnitude;
2. processing special categories of personal data on a prescribed scale or magnitude; or
3. processing which results in a risk of harm to the rights of the data subjects protected under the PDPA.

The Data Protection Authority has published the draft Personal Data Protection (Scale or Magnitude of Processing and Qualifications of Data Protection Officer) Regulations ("DPO Regulations"), for public consultation. These DPO Regulations are still in draft form and therefore may be subject to change. However, it may be noted that the DPO Regulations provide that the aforesaid scale and magnitude of processing ought to be assessed by taking into consideration the following:

1. whether the processing currently involves or is estimated to involve within the next twelve months, twenty-five thousand or more data subjects;
2. whether the processing is carried out by twenty or more persons;
3. the volume of personal data being processed;
4. the range of different data items being processed;
5. the geographical extent of the monitoring;
6. the frequency, nature and purpose of the monitoring; and
7. the duration or permanence of the monitoring.

The PDPA permits a group of entities to appoint a single DPO provided, however, such DPO is easily accessible by all of the group entities. 

Such DPO is required to be a competent individual possessing academic and professional qualifications in matters relating to data protection. The DPO Regulations prescribes that the DPO must possess:

1. a degree in law, public or business administration, information technology, information security, computer science, or a related field (each academic or professional qualification has to be one recognized in Sri Lanka); and
2. a good understanding of data protection laws and regulations of Sri Lanka.

The specific responsibilities of the DPO as per the PDPA includes:

• advising controllers or processers on data processing requirements;
• ensuring on behalf of the controller or processor that the requirements of the PDPA are met;
• enabling capacity building of staff engaging in data processing operations;
• advice on personal data protection impact assessments; and
• co-operation and compliance with all directives and instructions issued by the Authority.