The PDPA allows for cross-border data flow and the processing of data in a third country outside Sri Lanka, subject to the parameters set out in the PDPA.

Accordingly, a controller or a processor (including public authorities) may only effect cross border data flows (defined in the PDPA to mean the movement of personal data out of the territory of Sri Lanka for the purpose of processing personal data in a third country) only where:

1. the controller or processor effecting such transfer is able to ensure compliance with the obligations imposed under Part I, II and sections 20 to 25 of the PDPA (these include provisions dealing with substantive obligations of a controller and the rights of data subjects); and
2. by adopting an instrument that may be specified by the Authority to ensure binding and enforceable commitments of the recipient of data in the third country to ensure appropriate safeguards to the rights of the data subjects and remedies provided by under the PDPA; or
3. If the requirements of (a) and (b) above cannot be satisfied, the move out of Sri Lanka satisfies one of several derogations set out in the PDPA, which are as follows:
   
   • the data subject has explicitly consented, upon having been informed of the risks of such processing;
   • the transfer is necessary for the performance of a contract between the data subject and the controller, or the implementation of any pre-contractual measures taken by the controller at the request of the data subject;
   • the transfer is necessary for the establishment, exercise or defence of legal claims relating to the data subject;
   • the transfer is necessary for reasons of public interest;
   • the transfer is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or where his legal guardian is physically or legally incapable of giving consent;
   • the transfer constitutes only a transit of personal data through Sri Lanka; or
     any other condition that may be prescribed under the PDPA in the future.

The draft Personal Data Protection (Specification of Instruments for Processing of Personal Data Outside Sri Lanka) Directives (“Cross Border Instruments Directives”), published by the Data Protection Authority, stipulate the following types of instruments that may be adopted by controllers or processors, other than a public authority, to ensure binding and enforceable commitments of the recipient in the third country.

• binding corporate rules;
• an agreement;
• a code of conduct;
• a binding certification scheme; or
• a cross border processing impact assessment.

Further, for instances where a controller, processor or sub processor transfers personal data, for further processing, to a recipient in a third country to whom the PDPA may not apply, a resolution of the board of directors or equivalent authority of a controller must also be adopted. 

However, the said Cross Border Instruments Directives are still at draft stage and thus may be subject to change.

Accordingly, when considering the requirements in (a) and (b) above, it becomes clear that the PDPA obliges exporters to ensure that the obligations set out therein are upheld and that data subject rights and remedies remain protected after personal data is transferred to a third country.

However, while the use of a cross‑border transfer mechanism (such as standard contractual clauses) can impose binding commitments on the data importer, it cannot bind public authorities in the destination country. As a result, the assurances provided by such mechanisms may be undermined if local laws allow disproportionate government access to personal data or restrict individuals’ ability to obtain redress.

Therefore, a cross‑border transfer mechanism should be complemented by an assessment of the third country’s legal and enforcement framework, commonly referred to as a Transfer Impact Assessment (TIA), to confirm that PDPA‑level protections and data subject rights will be maintained following the transfer, and to identify any supplementary measures that may be necessary to ensure such protection.