What is the PDPA DSAR deadline?

Under Personal Data Protection Act No. 9 of 2022 (PDPA), the standard response deadline is 30 days. The counting method is calendar days, starting from the day of receipt.

Can I extend a PDPA deadline?

Yes. An extension of 30 days is available when: Complex or numerous requests requiring additional processing time. You must notify the data subject within: Within the original 30-day deadline with reasons for extension.

PDPA is enforced by Data Protection Authority of Sri Lanka. Maximum penalties: Up to LKR 10M (approx. USD 30,000) and/or imprisonment up to 3 years.

🇱🇰PDPA

Sri Lanka — PDPA DSAR Deadline Calculator

Calculate your exact response deadline under Personal Data Protection Act No. 9 of 2022 (PDPA).

Configure your DSAR

Select jurisdiction, request type, and date — results update instantly.

Jurisdiction

Your deadline will appear here

Select a jurisdiction and request type to get started

PDPA Overview

Full Name

Personal Data Protection Act No. 9 of 2022

Effective Since

2022-03-19

Regulatory Authority

Data Protection Authority of Sri Lanka

Official Text

View law

Maximum Penalties

Up to LKR 10M (approx. USD 30,000) and/or imprisonment up to 3 years

Request Types & Deadlines

Request Type	Deadline	Extension
Right of Access Sec. 17 — Right to obtain confirmation and access to personal data	30 days	+30 days
Right to Rectification Sec. 18 — Right to request rectification of inaccurate personal data	30 days	+30 days
Right to Erasure Sec. 19 — Right to request erasure of personal data	30 days	+30 days
Right to Restrict Processing Sec. 20 — Right to restrict processing of personal data	30 days	+30 days
Right to Portability Sec. 22 — Right to receive personal data in a structured format	30 days	+30 days
Right to Object Sec. 21 — Right to object to processing of personal data	30 days	+30 days

Extension Rules

Extension period: 30 days

Conditions: Complex or numerous requests requiring additional processing time

Notification required: Within the original 30-day deadline with reasons for extension

Special Rules & Common Mistakes

•Must respond to data subject requests within 30 calendar days
•Extension of up to 30 additional calendar days for complex requests with notification
•Sri Lanka PDPA is closely modeled on the EU GDPR
•Data Protection Authority established as the supervisory body
•Cross-border data transfer requires adequate protection in the recipient country
•Phased implementation with full enforcement dates determined by regulation
•Mandatory data protection impact assessments for high-risk processing

Compare with Other Jurisdictions

Law	Deadline	Method	Extension
🇱🇰 Sri Lanka PDPA	30 days	calendar days	+30 days
🇪🇺 EU GDPR	1 months	calendar months	+2 months
🇬🇧 UK GDPR	1 months	calendar months	+2 months
🇺🇸 CCPA	45 days	calendar days	+45 days