The PDPA requires controllers and processors which are not public authorities to appoint a Data Protection Officer (“DPO”) where their core activities consist of:

• processing operations that require regular and systematic monitoring of data subjects on a prescribed scale or magnitude;
• processing special categories of personal data on a prescribed scale or magnitude; or
• processing which results in a risk of harm affecting the rights of the data subjects protected under the PDPA as may be determined by the Authority by way of guidelines made under the PDPA.

The Authority has published the draft Personal Data Protection (Scale or Magnitude of Processing and Qualifications of Data Protection Officer) Regulations ("DPO Regulations"), for public consultation. These DPO Regulations are still in draft form and were published prior to Amendment Act coming into force. Therefore, they may be subject to change.

However, it may be noted that the DPO Regulations provide that the aforesaid scale and magnitude of processing ought to be assessed by taking into consideration the following:

• whether the processing currently involves or is estimated to involve within the next twelve months, twenty-five thousand or more data subjects;
• whether the processing is carried out by twenty or more persons;
• the volume of personal data being processed;
• the range of different data items being processed;
• the geographical extent of the monitoring;
• the frequency, nature and purpose of the monitoring; and
• the duration or permanence of the monitoring.

A DPO is defined in the PDPA to include a third party who is not directly employed by a controller or processor, but fulfils the responsibilities of a DPO, allowing controllers and processors to outsource the function of the DPO.

The PDPA also permits a group of entities to appoint a single DPO provided, however, such DPO is easily accessible by all of the group entities. Such DPO is required to be a competent individual possessing academic and professional qualifications in matters relating to data protection. 

The DPO Regulations prescribe that the DPO must possess:

• a degree in law, public or business administration, information technology, information security, computer science, or a related field (each academic or professional qualification has to be one recognized in Sri Lanka); and
• a good understanding of data protection laws and regulations of Sri Lanka.

The specific responsibilities of the DPO as per the PDPA includes:

• advising controllers or processers on data processing obligations or requirements;
• advising the controller or processor on complying with the provisions of the PDPA;
• facilitating capacity building of staff engaging in data processing operations;
• advising on personal data protection impact assessments; and
• co-operating and complying with all directives and instructions issued by the Authority.