This Privacy Policy complies with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka

Privacy Policy

Effective Date: January 27, 2025

Last Updated: January 27, 2025

1. Introduction

The National Aquaculture Development Authority (NAQDA) is committed to protecting your personal data in accordance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website and services.

For any queries regarding this policy, please contact our Data Protection Officer at privacy@naqda.gov.lk or call 011-2785020.

2. Data Controller Information

National Aquaculture Development Authority (NAQDA)

No. 41/1, New Parliament Road, Pelawatta, Battaramulla, Sri Lanka

Tel: 011-2785020 | Fax: 011-2786530

Email: info@naqda.gov.lk

Data Protection Officer: Mr. [Name] - privacy@naqda.gov.lk

3. Personal Data We Collect

We collect the following categories of personal data:

Identity Data

  • Full name and title
  • National Identity Card (NIC) number
  • Date of birth
  • Photographs (for identification purposes)

Contact Data

  • Residential and business addresses
  • Email addresses
  • Telephone numbers (mobile and landline)

Business Data

  • License and permit information
  • Farm/business registration details
  • Financial information for subsidies and grants
  • Training and certification records

Technical Data

  • IP address and browser information
  • Device and operating system details
  • Website usage data and cookies
  • Voice recordings (with explicit consent)

4. Legal Basis for Processing

We process your personal data under the following legal bases as per PDPA:

  • Consent: Where you have given explicit consent for processing
  • Contract: Processing necessary for license/permit applications
  • Legal Obligation: Compliance with Sri Lankan laws and regulations
  • Public Task: Processing necessary for public administration functions
  • Legitimate Interests: For improving our services and preventing fraud

5. How We Use Your Personal Data

Service Delivery

  • • Process license and permit applications
  • • Manage training program registrations
  • • Administer subsidies and grants
  • • Provide technical support services

Communication

  • • Send service updates and notifications
  • • Respond to inquiries and complaints
  • • Provide emergency alerts
  • • Share regulatory updates

6. Data Sharing and Disclosure

We may share your personal data with:

⚠️ We NEVER sell your personal data to third parties

  • • Other government agencies for regulatory compliance
  • • Law enforcement agencies when legally required
  • • Service providers under strict confidentiality agreements
  • • Financial institutions for subsidy/grant processing
  • • International organizations for export certifications

7. Your Rights Under PDPA

Under the Personal Data Protection Act, you have the following rights:

Right to Access

Request a copy of your personal data we hold

Right to Correction

Request correction of inaccurate or incomplete data

Right to Erasure

Request deletion of your data in certain circumstances

Right to Restrict

Restrict processing of your data in specific situations

Right to Portability

Receive your data in a structured, machine-readable format

Right to Object

Object to processing based on legitimate interests

How to Exercise Your Rights:

  1. Submit a written request to our Data Protection Officer
  2. Provide proof of identity (NIC copy)
  3. We will respond within 30 days of receiving your request
  4. No fee for first request; subsequent requests may incur administrative charges

8. Data Retention

We retain your personal data for the following periods:

Data Type Retention Period
License/Permit Records 7 years after expiry
Financial Records 10 years (legal requirement)
Training Records 5 years after completion
Voice Recordings 90 days (auto-deleted)
Website Analytics 2 years

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Technical Measures

  • • SSL/TLS encryption
  • • Firewall protection
  • • Regular security audits

Organizational Measures

  • • Staff training
  • • Access controls
  • • Confidentiality agreements

Compliance

  • • SLCERT certified
  • • ISO 27001 aligned
  • • Regular VAPT

10. Cross-Border Data Transfers

Your personal data is primarily stored and processed within Sri Lanka. Any cross-border transfers (e.g., for international certifications) are conducted with appropriate safeguards and your explicit consent as required by PDPA.

11. Cookies and Tracking Technologies

We use cookies to improve your experience:

Essential

Required for website functionality and security

Analytics

Help us understand how visitors use our website

Preferences

Remember your language and display settings

You can manage cookie preferences through your browser settings or our cookie consent tool.

12. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you are under 18, please do not provide any personal data through our website.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes through our website or by email. The "Last Updated" date at the top indicates the latest revision.

14. Complaints and Contact Information

Data Protection Officer

Email: privacy@naqda.gov.lk

Phone: 011-2785020 (Ext: 125)

Address: NAQDA Head Office, Pelawatta, Battaramulla

Data Protection Authority of Sri Lanka

If you are not satisfied with our response, you have the right to lodge a complaint with:

Data Protection Authority of Sri Lanka

Website: www.dataprotection.gov.lk

Email: info@dataprotection.gov.lk

Consent Management

Manage your consent preferences: