Your data, your control. The mechanics of compliance, made tangible.
The Personal Data Protection Act No. 9 of 2022 gave Sri Lankans the right to know, correct, port and delete. Here is how TaxWise honours each of those rights in product.
Six rights under the PDPA. Each takes one click in your account.
See everything we hold about you, exported in JSON and a human-readable PDF.
Request accessDelete your data, subject to the seven-year statutory retention for filed returns.
Delete accountFile a complaint with the Sri Lankan Data Protection Authority if you believe we've fallen short.
How to complainWhat happens to your data, end to end.
We only ask for fields the IRD return requires, or fields a relief specifically needs to be substantiated.
AES-256-GCM per-column encryption. Customer-specific keys held in AWS KMS Singapore.
Compute lives in ap-south-1 (Mumbai) with hot standby in ap-southeast-1 (Singapore). Data does not transit other regions.
We transmit returns to the IRD e-Filing system only after you have clicked 'Submit'. No other recipient receives your return data.
Tax data retained for the IRD's seven-year audit window, then deleted or anonymised within 30 days.
Encryption keys destroyed first; tombstoned record sweeps purge backing storage within 30 days.