We hold, collect and process the following categories of personal data that you provide us directly or indirectly, depending on the service provided:

• Identification data (Name, National Identity Card(NIC) Number, passport Number, Date of birth, gender, Nationality)
• Contact data (Address, Telephone number, Mobile number, email Address)
• Financial information (Bank account details, Transactions history, credit history, Credit and Debit Card Numbers, Credit information Bureau (CRIB) information.
• Employment and income information
• Biometric data (fingerprint/face recognition, Signature, Photographs, CCTV footage where applicable)
• Technical information, such as your device type, operating system, browser, IP address, and location when you use our website, mobile applications, or online banking platforms.
• Marketing and communicational data: your Preferences and opinions, such as your product and service preferences, feedback, complaints, and survey responses.
• At the time when we collect your sensitive personal data / special category of personal data such as Biometric data and child data and health data, we do so only when it is necessary and either with your explicit consent or as permitted by the law.

In alignment with the defined purposes of processing, People’s Bank, acting in its capacity as the Data Controller, collects personal data through a range of lawful, transparent, and appropriate channels. Personal data may be collected both at the commencement of a customer relationship and throughout its duration.

This includes information obtained through account opening documents, loan and credit applications, pawning documentation, leasing agreements, mandates, guarantees, collateral-related documents, and all other banking application forms, agreements, declarations, and instruments executed in the process of obtaining banking and financial services. It further encompasses information submitted through written application forms, electronic submissions, online banking platforms, mobile applications, telephonic communications, and any other authorised channels used in the provision of banking and financial services.

Personal data is also collected through the Bank’s branch network, ATM and CRM machines, cash deposit and withdrawal points, CCTV systems installed at branches and service locations, electronic and mobile banking platforms, online service portals, telephonic interactions, and other digital interfaces that support authentication, security, and service delivery functions.

Additionally, the Bank may obtain personal data from authorised external bodies and third-party sources, including the Credit Information Bureau (CRIB), regulatory authorities, statutory bodies, law enforcement agencies, service providers, and other institutions legally permitted to disclose such information for verification, compliance, and risk management purposes

All data collection activities are conducted in a fair, lawful, and transparent manner, ensuring that the personal data collected is strictly necessary, relevant, and proportionate to the specified, explicit, and legitimate purposes for which it is required.

We use and process your personal data to facilitate the delivery of banking and financial services, enhance operational efficiency, and comply with statutory and regulatory requirements. All processing is conducted in a lawful, fair, and transparent manner, strictly for specified, explicit, and legitimate purposes. We ensure that personal data is handled in an adequate, relevant, and proportionate manner, limited to what is necessary to fulfil the purposes for which it was collected.

Your personal data may be used for the following purposes:

1. Provide Banking Services



To enable the delivery of banking, financial, credit, and related services requested by customers, including account management, service maintenance, and provision of digital and physical banking channels.

2. Processing Customer Requests



To handle and fulfil applications, service inquiries, instructions, amendments, transaction processing, and other operational activities initiated by customers across branch, digital, and telephonic channels.

3. Credit Evaluation and Risk Assessment



To conduct creditworthiness assessments, evaluate repayment capacity, analyse financial behavior, manage credit exposures, support loan approvals, and undertake ongoing monitoring of credit facilities.

4. Operational and Statistical Purposes



To support internal operations, business analytics, performance evaluation, forecasting, statistical reporting, service optimisation, and strategic planning aimed at enhancing operational efficiency. And disseminating loan recovery reminders, internal record keeping, data analysis, research, statistical purposes, and to improve our products, services, and website.

5. Management of the Customer Relationship



To administer and maintain the banking relationship throughout its lifecycle, including communications, service updates, account reviews, and the management of customer interactions.

6. Marketing and Promotional Activities



To provide information on new or existing products, services, promotions, loyalty programmes, and personalised offerings, subject to your consent requirements and your preferences.

7. Cookies & Similar Technologies



Cookies are small text files stored in your browser or device memory when you access our website. Through the use of cookies and similar technologies, including pixels, tags, and web beacons, the Bank may collect and process personal data, behavioral data (such as pages visited and click activity), and technical data (such as IP address and device information).

The Bank utilizes different categories of cookies, including strictly necessary cookies, performance cookies, functionality cookies, and advertising/targeting cookies. The information collected through these technologies is used to enhance website functionality, personalize user experience, tailor advertisements and offers (including those displayed on the Bank’s platforms or third-party platforms such as social media networks), evaluate the effectiveness of marketing activities, and identify customer segments with similar interests. Where required by applicable law, the use of non-essential cookies shall be subject to the data subject’s consent.

Data subjects are provided with the ability to manage their cookie preferences, including the option to accept or reject non-essential cookies and to withdraw consent at any time through the cookie consent interface available on the Bank’s website.

8. Security and Fraud Prevention



To detect, prevent, and investigate fraud, unauthorised transactions, cyber incidents, financial crimes, and other security threats; and to safeguard physical premises, digital platforms, and critical infrastructure.

9. Compliance and Regulatory Obligations



To meet obligations imposed by the Central Bank of Sri Lanka, the Financial Intelligence Unit, tax and supervisory authorities, law enforcement agencies, courts of law, and other competent regulatory bodies. This includes statutory reporting, monitoring, due diligence, and record-keeping requirements.

We, as People’s Bank, may disclose your personal data only on lawful grounds, including: with your explicit consent, for the performance of a contract with you, to comply with legal or regulatory obligations, to protect the legitimate interests of the Bank without overriding your rights and freedoms, to safeguard the vital interests of you or another individual, or in situations involving the public interest or the exercise of official authority.

Your personal data may be shared with authorised parties, including:

• Regulators and government authorities (CBSL, FIU, courts, law enforcement, EPF/ETF authorities)
• Banks, financial institutions, and credit bureaus (CRIB, correspondent banks)
• Professional advisers and legal representatives (attorneys, auditors, consultants, guardians, power of attorney holders)
• Third-party service providers (IT, cloud, card processing, courier, insurance, recovery agents)
• Business and corporate partners (hotels, travel agents, merchants, charity partners, subsidiaries, affiliates)

We ensure that any disclosure is necessary, relevant, and proportionate for the intended purpose and complies with the Personal Data Protection Act, No. 09 of 2022.

As People’s Bank, we apply strong technical and organisational measures to keep your personal data secure and confidential. Access to your data is strictly limited to authorised employees, agents, contractors, and service providers who need it to perform their duties. All such parties are bound by confidentiality and legal obligations.

Key protections include:

• Encryption of data during storage and transmission
• Secure access controls and authentication measures
• “Need-to-know” access to minimise unnecessary data handling
• Regular security audits and monitoring
• Secure storage and proper disposal of physical and electronic records
• CCTV and physical security at bank premises
• Staff training on data protection and secure handling practices

We also maintain procedures to detect, manage, and respond to any suspected data breach. Where required by law, we will notify you and the relevant regulators promptly.

As a customer, you also play an important role in safeguarding your personal data. We encourage you to remain vigilant and take the following precautions:

• Be cautious of phishing emails, calls, SMS messages, and social engineering attempts that ask for your passwords, PINs, OTPs, or account details.
• Never share your PIN, OTP, passwords, or online banking credentials with anyone, including individuals claiming to represent the Bank.
• Regularly update your passwords and enable security features on your devices.
• Access our digital platforms only through official and verified channels.
• Review your account activity frequently and report any suspicious transactions immediately.
• Ensure your personal documents and bank cards are stored securely and not left unattended.

By following these measures, you can significantly reduce the risk of unauthorised access or misuse of your personal information.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including providing banking services, performing contractual obligations, or meeting our legitimate business interests.

Where not otherwise required, personal data is retained in line with Sri Lanka’s Right to Information Act (RTI Act). The exact retention period may vary depending on the type of service, agreement, transaction with the customer, or any legal requirement under applicable law.

We recognize and guarantees your rights under the Personal Data Protection Act (PDPA). You can exercise these rights by sending a request to the Bank. Your rights include:

1. Right of Access: Ask whether the Bank is processing your personal data and request a copy of the data.
2. Right to Withdraw Consent: Withdraw any consent you have previously given for the processing of your personal data.
3. Right to Object: Object to the processing of your data based on the Bank’s legitimate interests, unless there are overriding lawful reasons.
4. Right to Rectification: Request correction of inaccurate or incomplete personal data.
5. Right to Erasure (Right to be Forgotten): Request deletion of your personal data when it is no longer needed, consent is withdrawn, or processing is unlawful.
6. Right to Restrict Processing: Request a temporary limitation on processing in certain situations, such as when accuracy is disputed.
7. Right to Request a Review: If a decision about you is made solely through automated processing (including profiling) and significantly affects you, you can request review by a human decision-maker at the Bank.

Upon receiving your request, the Bank will acknowledge it promptly and respond within the timeframe required by the PDPA. Complex requests may require additional time, but you will be informed of the reasons for any extension. In addition to the rights listed above, you have the right to lodge a complaint with the Personal Data Protection Authority if you believe that your personal data has been processed in a manner that violates the PDPA. We encourage you to first contact our Data Protection Officer for any concerns, but you may escalate your complaint to the PDPA if you are not satisfied with the resolution.

People’s Bank may use automated systems, including profiling, to support decisions such as credit evaluation, risk assessment, or other banking operations. If a decision significantly affects you and is made solely by automated means, you have the right to request human intervention and a review of the decision. You may also request an explanation of the logic involved and the potential consequences of such processing. This ensures transparency and fairness in all automated decision-making processes.

This Privacy Notice may be updated periodically to reflect legal, regulatory, or operational changes. The most recent version will be published on the Bank’s official website and made available upon request.

The Data Controller is the entity responsible for determining the purposes and means of processing your personal data. For all personal data processed by People’s Bank, the



Data Controller is:

People's Bank
People's Bank Head Office (People's Tower)
No. 374, Dr. Colvin R De Silva Mawatha
Colombo 02, Sri Lanka

As the Data Controller, People’s Bank ensures that your personal data is processed in accordance with the Personal Data Protection Act, No. 9 of 2022, applicable regulations, and this Privacy Notice. All requests, inquiries, or complaints regarding the processing of your personal data should be addressed to the Data Protection Officer listed above.

If you have any questions about this Privacy Notice or our data protection practices, please contact our Data Protection Officer at: