Sri Lanka PDPA section 18 and automated decision-making

What it is

Section 18 of the Personal Data Protection Act No. 9 of 2022 is Sri Lanka’s rule on automated individual decision-making. It gives every data subject the right to request a controller to review a decision based solely on automated processing which has created, or is likely to create, an irreversible and continuous impact on their rights and freedoms. The Personal Data Protection (Amendment) Act No. 22 of 2025 widened this to rights and freedoms under the Constitution as well as any written law. The Data Protection Authority’s Circular No. 01/2026 names the right to equality and non-discrimination as an example.

The Act defines automated processing as processing that does not involve any manual processing. It defines profiling as processing personal data to evaluate, analyse or predict aspects of a person’s performance at work, economic situation, health, personal preferences, interests, credibility, behaviour, habits, location or movements. Credit scoring, applicant screening, fraud flags and eligibility checks run by an AI system all fit these definitions.

Who it applies to

Section 18 binds controllers, the organisations that decide the purposes and means of processing, wherever the Act applies. That includes controllers outside Sri Lanka that offer goods or services to people in Sri Lanka or profile them to make decisions about their behaviour there. An organisation that uses a vendor’s AI model to make the decision is still the controller. The vendor is usually a processor.

What it requires

Three elements engage the review right. There is a decision of the controller. It is based solely on automated processing, with no manual involvement. And it has, or is likely to have, an irreversible and continuous impact on the person’s rights and freedoms.

Section 18(2) disapplies the right in four cases.

• Written law. The decision is authorised by a written law the controller is subject to.
• The Authority. The decision is authorised in a manner determined by the Data Protection Authority.
• Consent. The decision is based on the data subject’s consent.
• Contract. The decision is necessary for entering into or performing a contract between the data subject and the controller. This exception does not cover special categories of personal data.

Where an exception applies, the controller must comply with the measures and criteria the Authority specifies by rules to safeguard the person’s rights and freedoms. Section 33(p) gives the Authority power to make rules on profiling and automated decision-making.

Under section 17 as amended, a controller must say in writing within one month whether it has granted or refused a request, with reasons for a refusal, and requests are free of charge unless the Authority sets criteria for a fee. The period can be extended by two months where the person is told in time. The controller must also tell the person about the right of appeal to the Authority.

Two Part I duties apply sooner. Section 11 and item (m) of Schedule V require controllers, when they collect personal data, to tell people about the existence of automated individual decision-making referred to in section 18, including profiling, with reasonably meaningful information about the logic involved and the significance and envisaged consequences of the processing. And section 24 in Part III requires a personal data protection impact assessment before any systematic and extensive evaluation of personal data, including profiling.

For an AI system, the practical questions are these. Which systems make decisions about people with lasting effects, and does a person genuinely review them before they take effect? Which exception would apply to each system that decides on its own? Can the organisation explain the logic in its notice? And is there a route for a person to ask for a review and get an answer within a month?

Key dates

• 19 March 2022. The Act certified, with section 18 in Part II.
• 30 October 2025. Amendment Act No. 22 of 2025 certified, extending section 18 to constitutional rights and replacing the appeal process in section 19.
• 1 January 2027. Part I and Part III in force under Gazette No. 2498/16, including the Schedule V notice and the impact assessment duty.
• To be appointed. Part II, including section 18, by a further order.

How it relates to other frameworks

Section 18 is narrower than GDPR Article 22, which gives a right not to be subject to a solely automated decision with legal or similarly significant effects. The PDPA instead gives a right to ask for the decision to be reviewed, and its threshold of an irreversible and continuous impact is its own. South Africa’s POPIA section 71 sits between the two, restricting such decisions unless an exception applies. The notice wording in Schedule V, which asks for meaningful information about the logic involved, closely follows the GDPR.

The work behind section 18 overlaps with the human oversight and transparency practices in ISO/IEC 42001 and the NIST AI RMF. An organisation that records which systems decide on their own, why, and how a person can challenge the outcome will have most of what section 18 asks for once Part II commences.

A note on this page

This is Aicura’s reading of section 18 and the related provisions of the PDPA as amended. It is not legal advice and it is not the Act itself. Read the Act and the amendment published by the Data Protection Authority, and take advice on how they apply to your organisation.