Sri Lanka People Privacy Notice
Last updated: 18 June 2025
- Who does this notice affect?
The Privacy Notice (“Notice”) covers our people and includes ‘you’, prospective, present and past employees, contractors, agency staff, collectively “Workers” and people connected to you (such as the person you nominate to contact in an emergency) (“Dependents”). Dentsu and its group of organisations (“Dentsu Group”) use global HR information systems (‘HRIS’) for employment management and recruitment purposes to capture and store personal data of Workers and Dependents. As we have no direct contact with your Dependents, it is your responsibility to notify such Dependents of the contents of this Notice insofar as it applies to them. Accordingly, references herein to “you”, also applies to your Dependents, where relevant. - Who collects your data?
Dentsu is a global media, creative and customer experience management group made up of several brands. It does business through its subsidiaries and affiliates worldwide. Your personal data is collected by the 外国美女色情片 organisation (“Dentsu Organisation”) that you entered into an employment contract or relationship or a contract for services with, have applied for a role with, or used to work for that acts as a data controller in relation to the personal data that is collected about you. Your personal data may need to be processed by other organisations within the Dentsu Group. If you have questions about which 外国美女色情片 organisation is a data controller in respect of your personal data, please contact your local HR team or, where applicable, your data protection officer. - What is not included?
The Notice is intended to tell you how we use personal information but is not intended to create a contract with you. This Notice does not apply to the information we hold about companies or other organisations, or to other companies or organisations collecting and using your personal information. You should review their privacy policies before giving them your personal information.
4. How do we collect your personal data?
When you provide personal data about yourself and others
This is personal data that you provide to the HR recruitment team or enter directly into our HRIS. You may also provide us with personal data about your Dependents. We use this information for HR administration and management reasons. Examples include the administration of employment benefits or contacting your next-of-kin in the event of emergency. To comply with our legal obligations, or where we need this information to fulfil our obligations to you under an employment contract or contract for services, certain data fields in our HRIS are mandatory. Where HRIS fields are voluntary it is your choice if you wish to provide the information requested.
We may collect personal data from other organisations
We may obtain information about you from other organisations. For example, references from your previous employer(s) and background checks where permitted by applicable law. We sometimes advertise through recruitment agencies or use the services of specialist search organisations. These companies will collect your application information. You may also be asked to complete a work preference questionnaire which is used to assess your suitability for the role you have applied for, the results of which are assessed by our recruiters. If you are applying to work with us through an agency, please review their privacy notice for details of how they will handle your information.
5. What kinds of personal data do we collect and how do we use it?
The personal data we collect about you and your Dependents depends on your circumstances, your role, applicable laws of Sri Lanka and whether you are a prospective, current or past Worker. Below you can find information we process for Workers and Dependents, as well as our purposes for doing so. We only process personal data for the purposes hereinbelow, to the extent permitted by applicable law and, where required, only when it can rely on any of the legal bases set out therein. If you are a Dependent, we will process your information as provided to us by our Workers.
Some personal data is, due to its nature, more sensitive than others (e.g. children’s data, health records, biometric data, criminal proceedings and convictions). The Personal Data Protection Act No. 9 of 2022 (the “PDPA”) recognizes such personal data as ‘special categories of personal data’. As a process, we do not collect any such information. However, if we proceed to collect such information, we will only process these special categories of personal data in limited circumstances, with your informed consent or under the grounds available in the PDPA, such as, where necessary for:
- the purposes of carrying out our obligations or exercising our/your rights in the field of employment in so far as it is provided for in any written laws of Sri Lanka;
- processing is necessary to respond to an emergency that threatens the life, health or safety of you or another natural person;
- processing relates to personal information which is manifestly made public by you;
- processing is necessary for the establishment, exercise or defense of legal claims;
or
- where processing is necessary for any purpose as provided for in any written laws of Sri Lanka or public interest.
RECRUITMENT
We will need to process the personal data of all prospective Workers from the moment you become a prospect or candidate for a role. This allows us to assess your suitability for the role and our business. The types of processing are as follows:
Purpose of processing your personal information | Detail | Grounds for processing |
Assessing suitability for the role. | We will use your personal information to assess your suitability for the role, enable shortlisting, prepare for any interviews and assessments required, and contact you to arrange, conduct, evaluate and feedback on assessments and interviews and, where successful, to make you an offer/provide you with an agreement/contract of employment. This applies to all Workers and applies whether you have made an application directly to us, have been added as a prospect or via an agency or any other third-party. For this purpose, we will collect:
Once working at Dentsu, we will also use your personal information to assess your suitability for other roles you may apply for or projects that may be assigned to you. | Legitimate Interest |
Applicant administration | We will carry out pre-employment checks (where permitted by applicable laws of Sri Lanka) either using inhouse resources or approved third-parties, to establish eligibility to work and other pre employment checks which shall be commensurate to the risks and responsibilities of each job role such as criminal record, financial sanctions, etc and follow up references provided to us and potential other sources where necessary. We will process and record the personal data of anyone given a job with Dentsu, even if they don't turn up on their first day. | Legitimate Interest, Legal Obligations |
Talent pool | If you are unsuccessful following assessment for the role or are a prospect, we will retain your details in our talent pool for a reasonable period so that we can contact you should any further suitable roles arise. The time for which we retain your details will differ depending on where you are based. For further details please contact the data protection officer of the Dentsu Organisation (“DPO”) identified in section 10 of this Notice. If you would like us to delete this data, please contact the data protection the DPO and we will be happy to triage your requests. Candidates can also request deletion of all data held in our HR system from their application login. | Legitimate Interest |
Reasonable adjustments | Where applicable, we will make reasonable adjustments to the recruitment process based on the accessibility requirements you make us aware of or we become aware of. For this purpose, we may, subject to the circumstances, collect information about you to help us assess adjustments which need to be made or work restrictions which may apply. This may include your nationality, preferred language, and details of any accessibility requirements. | Legitimate Interest |
WORKING FOR DENTSU
We will use your personal information for the purposes of your contract/agreement with us, to comply with legal obligations under applicable laws of Sri Lanka, where necessary, or where we have a legitimate interest in doing so to manage and protect our business. We will rely on legitimate interest pursued by Dentsu Organisation where it is not overridden by the interests or fundamental rights and freedoms of Our People. The table below lists out the ways in which we do so.
1. To Assist You in your role
Purpose of processing your personal information | Detail | Grounds for processing |
Employee Administration | We will maintain and process general records necessary for the management of Workers, to operate the contract/agreement of employment or contract for services between you and the Dentsu Organisation, and we will need to allocate and manage your duties and responsibilities and the business activities to which they relate. Depending on where you are based, we may process and record your personal data for purposes including, but not limited to:
| Legitimate Interest, Contractual Necessity, Legal Obligations, responding to an emergency |
Remuneration & benefits administration | This involves providing and administering remuneration, benefits (such as pension/retirement schemes, insurance, policies to benefit your health and wellbeing, etc), and recognition /incentive schemes. This may involve us passing appropriate personal information on to the relevant third-party providers so they can contact you, or you may register with them directly. We will also provide the details of any beneficiaries you nominate in case of death or other benefits to the relevant third-party. We may use third-party suppliers for benefits and recognition systems and we’ll make sure we follow the requirements of the law and that your personal information is protected by them appropriately. We will run pay benchmarking processes and reporting, if required by the applicable laws of Sri Lanka, and to ensure we are rewarding our employees appropriately with equal pay. We will process personal information in relation to staff awards, recognition schemes, and incentives to reward good performance. We may contact you or send you gifts on special occasions such as your birthday and to recognise ‘length of service’ milestones working for us. We will do this using any personal data you provide us with (either in a HRIS or more generally) but you can always ask for this to not happen by contacting your People Leader or raising a case via Ask People Services. | Legitimate Interest, Contract Necessity, Legal Obligations |
Conducting reviews and determining performance requirements. | Where applicable, we may need to conduct reviews to assess or investigate performance, capability, conduct, absence, or grievance concerns and other informal and formal HR or Legal processes, to make related management decisions and anything else required under our contract with you. We will review and track your performance at regular intervals. Your personal information will be stored to track your progress. The ways in which your data will be used may include:
| Legitimate Interest |
Processing employee work related claims | Where relevant, we will need to process any claim made by or involving you when a party is seeking compensation in cases of illness or injury. | Legitimate Interest, Legal Obligation |
Payroll management | This involves providing and administering payroll including tax and social security deductions and contributions, and any other deductions or garnishments required under applicable Sri Lankan law or your contract. We will often utilise third-party suppliers for benefits and recognition systems, and we’ll make sure we follow the requirements of the law and that your personal information is protected by the appropriate technical and organisational measures. | Legitimate Interest, Legal Obligation, Contractual Necessity |
Expense management | This involves reimbursing expenses where you have paid for something which is considered a genuine cost of business or providing access to corporate credit cards. We will often utilise third-party suppliers for expense systems and credit card schemes, we’ll make sure we follow the requirements of applicable laws in Sri Lanka, where necessary, and that your personal information is protected by the appropriate technical and organisational measures. | Legitimate Interest, Legal Obligation |
2. To Ensure Our Success As A Business
Purpose of processing your personal information | Detail | Grounds for processing |
Day to day business operations | We will process your personal data because of your day-to-day activities in your role with us at Dentsu Organisation. The type of data processed will depend on the nature of your role, but can include:
| Legitimate Interest, Contractual Necessity |
Business management and planning | Your personal data may be stored to allow the Dentsu Organisation to manage its business operations and plan appropriately for the future. This will include resource planning, project planning, staff cost management, resource allocation, client profitability analysis and timesheet compliance. Managers are required to assess their direct reports to assess Potential Level, Retention Risk and Impact of Loss. Your information will be processed for this on an ongoing basis. | Legitimate Interest |
Accounting & auditing | This includes managing forecasting, budget / account management and planning for the future. From time to time, we will disclose your personal data to third-party service providers (e.g. Microsoft Dynamics 365) to assist in our accounting and auditing processes. | Legitimate Interest |
Preventing and detecting crime | We use your information to prevent and detect unlawful activity, including IT and building access rights and security monitoring, use of CCTV, fraud detection and prevention measures. | Legitimate Interest |
Network and information security | We have systems in place to prevent unauthorized access to our computer and electronic communications systems and preventing the distribution of malicious software. Your personal data is processed for several reasons, including authenticating legitimate users, contacting you in the event of an incident, training and testing in phishing awareness, setting up IT alerts, and restricting where corporate data can be stored. To further enhance security, we have deployed a secure corporate browser for Dentsu-managed devices and for Dentsu corporate apps on personal devices. This system monitors user browsing activity to protect against malicious websites, threats, and malware, capturing and storing all browser-related traffic, including (but not limited to) websites visited, data transfers, IP addresses, and Dentsu email addresses. Please note: This system will not:
| Legitimate Interest |
Support internal administration with our affiliated entities. | This can include planning, due diligence and implementation in relation to a commercial transaction or service that impacts your relationship with Dentsu. For example, mergers and acquisitions or a transfer of your employment under automatic transfer rules. | Legitimate Interest |
Data analytics and reporting | We do this to review and better understand employee retention and attrition rates, and to understand the success of our systems / programmes. This helps inform our business decisions and we will often use the assistance of external parties to do this. Your information may be gathered for business operational and reporting documentation such as the preparation of annual reports, which may use photographic images and graphs, and staff engagement or benchmark questionnaires. Your data, if used, will normally be anonymised so that you would not be personally identified. We will also run data mining to assess the success of our systems and analyse how we can help you work more efficiently. | Legitimate Interest |
3. To Keep Us Compliant
Purpose of processing your personal information | Detail | Grounds for processing |
Complying with applicable law | We are required to monitor and document activity as required to demonstrate compliance under applicable laws of Sri Lanka. This includes conflict of interest records, gifts and hospitality and anti-bribery and corruption reporting, and mandatory compliance training. This also includes our obligations in relation to maternity or parental leave legislation, working time and health and safety legislation, taxation rules, worker consultation requirements, other employment laws and regulations to which the Dentsu Organisation is subject to. Personal data is also kept enabling us to process data subject rights requests employees may have during or after their employment with Dentsu Organisation. We will occasionally, where necessary, need to comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country. | Legal Obligations |
Education, training, and development requirements | Throughout your employment with the Dentsu Organisation, you will undergo various training programmes to both enhance your skills and also to fulfil mandatory compliance requirements, as maybe required under applicable Sri Lankan laws. This depends on your role and where you are working, but can include:
| Legal Obligations, Legitimate Interest |
Complying with health & safety obligations | This will include us needing to process information about absence or where required or permitted by applicable law of Sri Lanka, medical information regarding physical or mental health or condition in order to: assess eligibility for incapacity or permanent disability related remuneration or benefits; determine fitness for work; facilitate a return to work; make adjustments or accommodations to duties or the workplace; and make management decisions regarding employment or engagement, or continued employment or engagement, or redeployment, and conduct-related processes. This includes providing support in work related injuries, illness, management of your health and safety, providing any accessibility support you may need (including where you make us aware in your health declaration upon joining us and as updated by you when appropriate) and contacting your emergency contact if ever needed. This may include us making a referral to the occupational health service and assisting you with ill health retirement applications. Any staff members who require assistance exiting the building in an emergency will have their information provided to fire marshals by way of Personal Emergency Evacuation Plans (PEEPS). Those fire marshals and any first aiders will also have their information stored on company systems, including the training they have received. We are also required by law to record details of any accident that occurs in the workplace. | Legal Obligations, Legitimate Interest, Responding to an emergency that threatens the life, health or safety of the employee |
Business continuity | We may contact you in the event of an emergency or potential threat to you or our business such as a natural disaster or cyber-attack. Such emergencies or disasters might include a fire or any other case where business is not able to occur under normal conditions. To ensure you are promptly informed about such events, we may use any personal data you provide us with (either in a HRIS or more generally) which may include your private contact details e.g. private phone number or email. The following are the scenarios in scope:
| Legitimate Interest |
4. To Resolve Disputes
Purpose of processing your personal information | Detail | Grounds for processing |
Gathering evidence for disciplinary action or termination.
| Sometimes we may need to gather personal data in relation to any allegations, complaints, investigations and disciplinary processes that occur during your time working at the Dentsu Organisation, whatever your role in the process, as required in terms of applicable laws of Sri Lanka. This can include "whistle blowing or speak up now" reports from employees and are handled through third-party services. Evidence in all cases will need to be gathered and recorded for the duration of any investigation. We may also need to manage litigation proceedings on behalf of Dentsu. Your data may be processed where required. | Legal Obligation, Legitimate Interest, or Establishment, exercise or defense of legal claims |
Monitoring of work communications | In accordance with relevant laws of Sri Lanka, we may monitor and scan electronic communications sent using the accounts, network and equipment we provide to you for work purposes. This is to ensure that the Dentsu IT resources are being used in compliance with the law and are in line with the Dentsu policies. You can learn more information about using Dentsu IT resources in our Acceptable Use Policy on Neon. | Legitimate Interest, Legal Obligation |
AFTER YOU LEAVE DENTSU
After you end your role with us, we may need to retain your personal information to fulfil certain business obligations for the following purposes:
Purpose of processing your personal information | Detail | Grounds for processing |
Employee administration | When you leave the Dentsu Organisation, we run certain processes involving your personal data to understand why you left us, to help run our business or to support a legal obligation we have. When you leave, we may conduct an exit interview and ask you to take part in a leaver’s survey. Your data will be used when we are preparing for your departure, for example when you are returning IT equipment or corporate credit cards. This may involve the use of your home address if you are working remotely. We will also retain information to manage and administer your super annuation benefits and other related legal obligations. | Legitimate Interest, Legal Obligations |
Processing employee work-related claims | Sometimes we need to deal with claims or disputes involving you or others. This could include an accident at work. We do this because we have a legal obligation to provide the information, or it is in our interests to bring or defend a claim. | Establishment, exercise or defense of legal claims, Legal Obligation or Legitimate Interest |
Business management and planning | After you leave, we will retain certain information to understand and evidence decision making in your role and maintain knowledge within the business; for example, this may include your handover notes or emails you have sent. We do this because it is in our interests to use this information to help run our business, or it may be to support a legal obligation we have. We may also ask if you’d like to opt in to our alumni marketing programme whereby you can receive communications about Dentsu and information about new job openings. | Legitimate Interest, Consent (for alumni marketing programme)
|
Complying with applicable law | Where required under applicable laws in Sri Lanka, we may need to use your personal information to comply with our obligations to third parties in connection with your employment, such as tax authorities and professional bodies. | Legal Obligations |
6. Sharing your information
Across Dentsu:
Dentsu is a global organisation. To ensure effective and efficient services and communications throughout the group, your personal data may be shared with other organisations within the Dentsu Group, for example with our group companies oversease and the USA.
The following people and teams within Dentsu may be granted, on a need-to-know basis, access to your personal data:
- Local, regional and global HR managers and HR team members;
- Local, regional and executive management responsible for managing or making decisions in connection with your relationship with 外国美女色情片, or when involved in an HR process concerning your relationship with 外国美女色情片, system administrators; and
- Where necessary for the performance of specific tasks or system maintenance, teams such as the Finance, Legal & Compliance, Technology & Security and HR teams.
Basic personal data, such as your name, location, job title, contact information, any published skills and experience profile, as well as any photo that you upload to the HRIS, may be accessible to other employees to facilitate standard business operations.
Outside Dentsu:
Your personal data may be also shared with organisations outside of the Dentsu Group. To help you understand who these organisations are, here is a non-exhaustive list:
- Third-party suppliers: Organisations (and their sub-contractors) that provide us with technology solutions and/or support such as the organisations that have been engaged to host, support and otherwise maintain systems we use to process your personal information. This could also include organisations that provide systems which interconnect with the HRIS or are used more generally. Examples include expense management software, payroll and benefits systems, IT servicing technology and many more. Where we use a third-party service provider we’ll make sure we follow the requirements of the law and that your personal information is protected by the appropriate technical and organisational measures.
- Dentsu’s professional advisers: We may need to share your information with professional advisers including but not limited to IT administrators, auditors, consultants, payroll providers, external lawyers, administrators of Dentsu’s benefits programmes.
- Insurance providers: We may also need to share your information with insurance providers in relation to our insurance policies.
- Clients: We may share your information with our clients where necessary to manage and deliver services to them.
- Public authorities: We may share your information with public authorities to comply with lawful requests (including without limitation to meet national security or law enforcement requirements) or where otherwise required, whether within or outside your country. We only share your personal information in accordance with applicable laws and have strong internal oversight of what we do and take expert advice to inform our approach.
In any event, your personal data will be processed outside of Sri Lanka only in a country prescribed by the Minister in charge of the subject of data protection in Sri Lanka, pursuant to an adequacy decision, or if it is in a country not so prescribed, only when we are satisfied that:
(i) regardless of transfer of your personal information to such country, we are able to comply with our mandatory obligations under the data protections laws of Sri Lanka; and
(ii) only after executing an appropriate instrument as prescribed by the Data Protection Authority of Sri Lanka, with the recipient of data in such country; or
(iii) in the absence of (ii) above, only to the extent permitted by the PDPA.
7. Protecting your information and how long we keep it for
How do we protect your personal information?
We have implemented appropriate technical and organisational measures to protect your personal information. These include but are not limited to, physical building controls, device and file encryption and ID verification. Where we transfer your personal information to third-party provider we only do so where we have the appropriate safeguards in place to protect your personal data.
How long do we keep your personal information?
We keep your personal data for as long as it is required to fulfil such purpose(s) for which it was collected. This will usually be the period of your employment or contract for services, or as otherwise set out in the context of prospective employees or other, with the Dentsu Organisation plus the length of any applicable statutory limitation period once that employment or contract period has ended. For example, data such as tax information, may need to be kept for longer. Otherwise we will delete or anonymise it so that you cannot be identified and it can no longer be associated with you.
Further information about our data retention policies and requirements for different categories of data we use across our network is available.
8. Your rights
Depending on the applicable privacy law of the market you are in, you may have several rights in relation to your Personal Data, including:
Objecting to further processing of your personal data. Where we rely on legitimate interest (or those of a third-party) and if you feel it impacts on your fundamental rights and freedoms, you can object to us further processing. You can object for such further processing at any time, and we shall stop further processing .
Accessing your personal data. We may be required to provide you with information we hold about you upon your request, including a description and copy of the personal data and why we are processing it, unless a lawful exception applies.
Requesting erasure (deletion) of your personal data. You may ask us to delete your data where you think we no longer require it. Note, we may be required to retain certain personal data by law and/or for our own legitimate business purpose. But when we do so, we will inform you.
Requesting correction or updating of your personal data. This enables you to have any incomplete or inaccurate Personal Data we hold about you completed or corrected.
Requesting the restriction of our processing of your Personal Data. In certain limited situations, you can request a restriction to our processing such as where we are required to maintain your Personal Data for evidentiary purposes under Sri Lanka law or on an order of a competent court without rectifying, despite your request for correction. If you request this, we can continue to store your Personal Data but are restricted from processing it while the restriction is in place.
Withdrawing your consent. Where you have consented to our processing of your Personal Data, you can withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of what we have done with your personal data before you withdrew consent or affect our right to continue with our collection, use or disclosure of your personal data where such collection, use or disclosure of personal data is permitted under applicable laws without consent.
Making a Complaint. You can exercise your rights set out in this Privacy Notice by sending us a written request by post or email to the DPO identified in section 10 below. We will do our best to resolve any complaint. However, if you feel we have not resolved your complaint, or if you wish to reach out to them directly, you can complain to your local data protection authority. If you have any questions about who your local authority is, please contact us and we can provide the relevant information.
If you exercise the rights above, the request in writing should include your contact information and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. In addition, you should provide adequate information that we can reasonably verify that you are the person about whom we collected the personal information (including information that enables us to verify the identifying information we possibly maintain about you).
We will respond to requests within the required timeframes. To protect your personal data, we will only honour requests if we have been able to verify your identity or authority to make the request and confirm the personal data relates to you. The method used to verify your identity will depend on the type, sensitivity and value of the information, including the risk of harm to you posed by any access or deletion. Verification will usually be performed by matching the identifying information provided by you to the personal information that we already have.
We may charge a fee to fulfil such requests made by you as permitted under the PDPA.
9. Updates
Our Notice might change from time to time. We’ll notify you about any changes to the Notice by posting on our website, internal intranet or contacting you directly.
10. Contact us and further details
If you have any questions about this Notice, our approach to privacy or you would like to exercise any of the rights mentioned in this Notice you can contact our DPO at dpo.srilanka@外国美女色情片.com.
11. Glossary
Dentsu organisation | The specific 外国美女色情片 entity that entered into an employment contract or relationship or a contract for services with you. |
Data controller | The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. This will be the 外国美女色情片 organisation that entered into an employment 外国美女色情片 or contract for services with you. It may also include other 外国美女色情片 organisations that need to process your personal data for their own purposes. |
Other 外国美女色情片 organisation | The parents, affiliates, and/or subsidiaries of the 外国美女色情片 organisation described above. |
Processing (or Processed) | Any operation which is performed on personal data - such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. |
Personal Data | Personal information means information that identifies you as an individual, or is capable of doing so. Any information relating to an identified or identifiable person. An identifiable person is someone who can be identified, directly or indirectly, by reference to details such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. |