HR Perspective – Sri Lanka
Cybersecurity is not only an IT responsibility; HR also plays an important role in protecting employee information, company data, and confidential business records.
From an HR and legal perspective, organisations should establish clear policies covering data protection, acceptable use of company systems, passwords, email, social media, remote working, and employee confidentiality.
Under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, organisations handling personal data have important responsibilities regarding the lawful processing and protection of personal information.
Key HR responsibilities:
- Maintain confidentiality of employee and company information.
- Establish clear cybersecurity and IT-use policies.
- Control access to sensitive employee data.
- Provide cybersecurity awareness training.
- Include confidentiality and data-protection obligations in employment documentation.
- Investigate suspected data breaches or misuse fairly.
- Apply disciplinary procedures consistently when employees breach established policies.
- Maintain proper records of incidents and investigations.
HR & Labour Law Note:
An employee’s misuse, unauthorised disclosure, or negligent handling of confidential information may raise disciplinary and employment-law issues, depending on the facts, applicable policies, employment terms, and evidence. Any disciplinary action should follow a fair and procedurally sound process, including giving the employee an opportunity to respond.
Key legislation: Personal Data Protection Act, No. 9 of 2022; Computer Crimes Act, No. 24 of 2007.
This note is for general HR and legal awareness and should not be treated as case-specific legal advice..
