Skip to content
Data protection · PDPA

Your data, your control. Here’s how that works in practice.

The Personal Data Protection Act No. 9 of 2022 gave Sri Lankans the right to know, correct, port and delete. Here is how TaxWise honours each of those rights in product.

Personal Data Protection Act No. 9 of 2022 · Applies to every TaxWise account

The short version

  • Six rights under the PDPA. Each takes one click in your account.
  • Your data is stored and processed in AWS Singapore only.
  • Kept for seven years at most, then deleted within 30 days.
  • A named Data Protection Officer answers within 14 days.

1.Your six rights

Six rights under the PDPA. Each takes one click in your account.

Right of access

See everything we hold about you, exported in JSON and a human-readable PDF.

Request access

Right to rectification

Correct inaccurate or incomplete personal data we hold.

Edit your data

Right to erasure

Delete your data, subject to the seven-year statutory retention for filed returns.

Delete account

Right to portability

Download your filings and account data in a machine-readable format.

Export data

Right to restrict

Pause processing while a dispute or query is resolved.

Restrict

Right to complain

File a complaint with the Sri Lankan Data Protection Authority if you believe we've fallen short.

How to complain

2.What happens to your data, end to end

  1. 01
    Collection

    Minimisation at the form

    We only ask for fields the IRD return requires, or fields a relief specifically needs to be substantiated.

  2. 02
    Storage

    Encrypted at rest, sharded by tenant

    AES-256-GCM per-column encryption. Customer-specific keys held in AWS KMS Singapore.

  3. 03
    Processing

    In AWS Singapore only

    Compute lives in AWS Singapore (ap-southeast-1), across multiple availability zones. Your data does not transit any other region.

  4. 04
    Sharing

    No third-party transmission

    We do not transmit your return data to the IRD or any other party. You export schedules from TaxWise and submit through the IRD e-Filing portal yourself.

  5. 05
    Retention

    Seven-year statutory window

    Tax data retained for the IRD's seven-year audit window, then deleted or anonymised within 30 days.

  6. 06
    Disposal

    Crypto-shred plus tombstone

    Encryption keys destroyed first; tombstoned record sweeps purge backing storage within 30 days.

3.Your Data Protection Officer

Data Protection Officer
Tharushi Bandara

Specialises in financial-services PDPA and the Sri Lankan implementation of cross-border tax data transfer.

privacy@taxwise.lk