Image: Dan Nelson / Unsplash
A request for a photo of your NIC can feel completely ordinary. A landlord asks for it. A seller asks for it. A new employer asks for it. Someone says, “Just WhatsApp it to me.” And because sending a photograph takes five seconds, we often spend less time thinking about the information we are handing over than we spend choosing a filter for a family photo.
But an NIC image is not just a picture. It can contain a person’s name, identification number, photograph and other information that may become valuable when combined with information from somewhere else. Sri Lanka’s Personal Data Protection Act (PDPA) provides a framework for the processing of personal data, and the Data Protection Authority describes personal data as information that can identify a person directly or indirectly. Read the PDPA.
The HICONT rule: purpose before photograph
Before you send the image, ask one calm question: “What exactly is this copy needed for?” A legitimate need does not automatically mean you should send the clearest possible image to the first person who asks.
Do not confuse convenience with necessity
A person may genuinely need to verify your identity. That is different from needing unrestricted possession of a perfect copy of your NIC forever. The practical question is not “Is this person good or bad?” It is “What is the minimum information reasonably needed for this purpose?”
Five small habits that make a big difference
- Do not post NIC photographs in public groups or social-media comments.
- Avoid sending the same full-resolution copy to multiple unrelated people.
- If an organisation provides a secure upload portal, prefer that over ordinary messaging when practical.
- Keep a simple note of where you have sent important identity documents.
- If you suspect misuse, preserve the messages, dates and recipient details instead of immediately deleting everything.
What does Sri Lanka’s data-protection framework change?
The PDPA gives data subjects rights that include access to personal data and, in specified circumstances, withdrawal of consent where processing is based on consent. The DPA states that the relevant parts of the Act became operational from 18 March 2025. See the DPA’s operationalisation notice.
This does not mean that every person can simply refuse every identity request. Different legal, contractual and regulatory bases may exist for processing information. The safer lesson for ordinary life is simpler: know why your information is being collected, who is receiving it, and keep enough evidence to explain what you consented to.
If you have already sent it
- Do not panic. First identify exactly who received the image.
- Ask the recipient why it is needed and how it will be stored or deleted when no longer required.
- If the request now looks suspicious, preserve the conversation, profile information, phone number and payment or transaction records.
- If you believe your personal data has been mishandled, consider getting specific legal or regulatory advice rather than relying on social-media advice.
A human rule worth remembering
We are often taught to protect money, passwords and valuables. Modern life requires another habit: protect information that can be used to describe who you are.
Your NIC photograph may be necessary for a legitimate transaction. That is not the same as saying it should travel casually from phone to phone.
HICONT practical takeaway: Before you press Send, know the purpose, the recipient and the reason the full document is necessary. Keep a record. When in doubt, ask the question before sharing—not after.
This article is general legal information, not advice on a particular data incident. For Sri Lankan data-protection information, use the official Data Protection Authority sources.