1. Privacy Commitment & Statutory Alignment

The Ministry of Industry and Entrepreneurship Development is committed to safeguarding the privacy and personal data of business owners, corporate executives, and system users. This Privacy and Data Protection Policy is established in accordance with the provisions of the Personal Data Protection Act, No. 9 of 2022 (PDPA) of Sri Lanka, as amended from time to time, together with applicable regulations, directions, circulars, standards and other legal requirements concerning public-sector processing, information security, records management, access to information and electronic government services and applicable statutory data security frameworks.

This Policy applies to information submitted through the Portal, information generated through Portal use, and information obtained or verified from lawful sources in connection with the Portal. It applies to Registered Users, persons whose Personal Data is included in enterprise records, and visitors to the public-facing portions of the Portal, as applicable.

The Ministry shall update its data protection arrangements when applicable laws, regulations, directions or official guidance change.

2. Personal & Enterprise Data We Collect

During user account setup, business profile creation, and ongoing system interactions, NIIS collects the following categories of data which are essential and relevant for the purpose of NIIS and the Ministry.

1. Enterprise identification and general information: business/entity name, address, location and related identification details.

2. Contact information: telephone, mobile, email, website and details of a responsible/contact person.

3. Government and registration information: registration institutions, registration numbers and registration dates.

4. Legal and business information: legal status, business category and industry/ISIC classification.

5. Business activity information: descriptions of business activities, production, products, HS codes, units, quantities and values.

6. Raw material and input information: local/import status, material names, HS codes, units, quantities and values.

7. Sales and market information: local and export sales, quantities, values and countries/markets.

8. Investment and finance information: investment sources, investment types, financial institution and loan-related information.

9. Employment information: employee categories, sources, gender counts, age categories and information concerning leadership.

10. Energy and resource information: energy types, quantities, electricity generation and fuel use.

11. Environmental information: waste types, quantities and disposal methods.

12. Standards and achievements: certifications, awards, award dates, sources and awarding agencies.

13. Tax and statutory payment information, where collected through the Portal.

14. Account and technical information: username/account details, authentication information, logs, IP address, browser/device information and other technical information necessary for security and administration, where applicable.

15. Communications and support information: information provided when a user contacts the Ministry or Portal support team.

3. Purpose of Processing & Government Data Utilization

The data collected within the NIIS repository is processed lawfully for the following defined state and public purposes:

1. Industry Registry:Maintaining a national enterprise and industry information resource.

2. National Economic Analysis:Enabling the Ministry to analyze industrial density, sector growth rates, regional industrial disparities, and macroeconomic trends.

3. Policy Formulation: Supporting industrial and economic policy formulation.

4. Planning and Decision making:Supporting evidence-based planning and decision-making by the Ministry

5. Grant Administration:Evaluating eligibility for government subsidies, industrial soft loans, technology transfer grants, tax incentives, and SME relief programs.

6. Emergency & Resource Allocation:Managing industrial fuel quotas, utility allocation, raw material supply chain disruptions, and crisis support mechanisms.

7. Official Business Verification: Verifying enterprise existence for statutory services, including industrial visa recommendations and export facilitation.

8. Public Business Directory:Displaying non-confidential public tier fields to promote trade and B2B linkages.

4. Data Access Controls & Public vs. Confidential Tiering

The NIIS system strictly enforces granular role-based access control (RBAC). Accordingly, the Ministry will protect the confidentiality of the data obtained and disclose only limited information.

1. Public Portal Access:The public can search and view ONLY selected enterprise data fields (e.g., Entity Name, BR Number, Business Type, Sector, District, Public Phone, and Official Email). Sensitive financial, personal identity, and operational data are completely hidden from public access. The exact public field set may be changed from time to time.

2. Ministry Administrative Access:Full database fields are accessible exclusively by authenticated, authorized Ministry officials bound by non-disclosure and statutory secrecy obligations under Sri Lankan administrative regulations.

5. Data Accuracy and Data Quality

The Ministry will take reasonable steps appropriate to the nature and purpose of processing to maintain accurate and up-to-date Personal Data. Registered Users are expected to provide accurate information and update their records when material information changes.

The Ministry may verify information through lawful sources, request supporting documents, identify inconsistencies, correct technical errors, or mark information as unverified where appropriate.

6. Information Sharing & Third-Party Disclosures

The Ministry does NOT sell, rent, or commercialize enterprise or personal data. Data may only be shared under strict legal channels with:

1. Inter-Governmental Bodies:Partner state entities (e.g., Department of Inland Revenue, Sri Lanka Customs, Export Development Board, Department of Census and Statistics) solely for official statutory cross-verification and national economic planning.

2. Law Enforcement & Judiciary:Competent legal authorities upon receipt of a lawful court order, search warrant, or legal obligation under Sri Lankan law.

Disclosure may also occur where required or authorized by law, court order, audit requirement, statutory duty, regulatory requirement, public-sector reporting obligation or other lawful authority.

7. Data Security, Storage & Safeguards

The Ministry implements robust technical, physical, and organizational security measures to protect data against unauthorized access, loss, alteration, or breach. Measures include end-to-end SSL/TLS encryption for data in transit, encrypted database storage, strict firewall configurations, regular security audits, multi-factor authentication for administrative users, and restricted server access within secured government cloud infrastructure. This further ensures that data is securely protected and can only be accessed by authorized individuals.

8. Data Breaches and Security Incidents

The Ministry shall maintain an incident-management process for suspected or confirmed data breaches and security incidents. Incidents should be assessed, contained, investigated, documented and remediated in accordance with applicable law, official directions and the Ministry’s incident-response procedures.

Where notification to affected persons or the Data Protection Authority or another competent authority is required, the Ministry shall make such notification within the applicable legal or regulatory timeframes.

9. Data Retention & User Rights

1. Retention Policy:Enterprise records are retained in the active registry for the duration of the enterprise's operational lifespan. Historical data is archived securely for statistical longitudinal analysis. Moreover, as per the provisions of the Personal Data Protection Act on 9 of 2022 retention of personal data will only be kept for as long as necessary, subject to legal retention requirements.

2. User Rights (Under PDPA):Registered entities and individual data subjects possess the right to:

   • Access and review their stored personal and enterprise profiles.

   • Request rectification of inaccurate, outdated, or incomplete details.

   • Lodge formal inquiries regarding data processing activities.

10. Data Processors and Service Providers

The Ministry may engage with ICT service providers, hosting providers, software developers, security providers, maintenance providers and other processors to operate or support the Portal. Such parties shall only process information in accordance with authorized instructions, applicable contractual obligations and relevant legal and security requirements, throughout the contractual period. The Ministry should maintain appropriate records of processors and ensure that contracts or other arrangements contain suitable confidentiality, security, breach-management, access and deletion/return provisions.

11. Public Access, Transparency and Access to Information

The Ministry recognizes the importance of transparency in public administration. Requests for access to information will be handled under applicable Sri Lankan law and government procedures.

Nothing in this Policy creates an unrestricted right to access confidential Personal Data or commercially sensitive information. Any disclosure must take account of applicable privacy, confidentiality, security, statutory and public-interest requirements.

12. Complaints

A person who believes that their Personal Data has been processed improperly may contact the Ministry through the designated privacy contact. Complaints will be recorded and reviewed in accordance with the Ministry’s procedures and applicable law. Where a person has a statutory right to complain or appeal to the Data Protection Authority or another competent body, that right remains available.

13. Amendments & Policy Updates

The Ministry reserves the right to update or amend this Privacy and Data Protection Policy at any time to reflect administrative changes or evolving statutory requirements under Sri Lankan law. Material changes will be published on slenterprises.gov.lk with an updated revision date.

Official Contact Details for Data Privacy

For questions regarding these Privacy and Data Protection Policy, or data protection rights, please contact:

Document Control