Data Protection in Sri Lanka

Electronic marketing in Sri Lanka

The data protection principles enshrined in the PDPA apply in relation to any electronic marketing activity carried out using personal data.

In addition, if direct marketing messages are to be sent using electronic or any other means, the controller must first obtain consent from the data subject prior to sending such message, which are identified as ‘solicited messages’ under the law.

Therefore, unlike the GDPR, legitimate interests cannot be used as the legal basis for processing personal data in sending electronic marketing messages to data subjects.

Consent under the PDPA is required to be freely given, specific, informed and unambiguous indication in writing or by affirmative action. The conditions governing consent under the PDPA set out that:

  • the controller should be able to demonstrate that consent was obtained from the data subject;
  • if consent is provided in a written form which also concerns other matters, the request for consent should be clearly distinguishable;
  • the performance of a contract should not be conditional on a data subject’s consent to processing his personal data that is not necessary for the same; and
  • the data subject must be informed, before they give consent, that they may withdraw consent at any time.

Additionally, when sending solicited messages, the controller should:

  • provide the data subject information on how they may opt out of receiving such messages, free of charge; and
  • inform the data subject of the nature of the message, to whom it is intended, and the identity of the controller or the third party on whose behalf the controller is disseminating the message.

The PDPA also allows the Authority to introduce rules, codes or prefixes that controllers should adopt to identify different categories of solicited messages. However, given that the law is in its transitional stage, such rules have not yet been introduced.

The aforesaid restrictions on marketing would not apply where marketing is aimed at corporate subscribers.

Continue reading

  • no results

Previous topic
Back to top