Your phone may know more about your life than the file cabinet in your house. It may contain photographs of your children, identity documents, bank alerts, workplace conversations, medical appointments, location history and copies of things you once sent because someone said, “Just WhatsApp it to me.”
That does not mean every request for information is unlawful. It does mean that we should stop treating personal information as if it has no value simply because it can be sent in two seconds.
A useful HICONT habit: pause before you share
Ask three quiet questions: Who is asking? Why do they need it? What is the safest way to give only what is actually necessary?
What counts as a risky moment?
The obvious danger is a stranger asking for an OTP. The less obvious moments are ordinary requests: a photograph of an NIC for a form, a scan of a deed sent to an unknown number, a screenshot containing an account number, a child’s school document shared in a group, or a full identity document sent when only a name was needed.
Sri Lanka’s Data Protection Authority describes the Personal Data Protection Act, No. 9 of 2022 as a framework governing personal-data processing and lists later amendments and operational measures on its official guidance pages. The DPA states that the core enforcement provisions commenced on 18 March 2025. See the DPA’s operational information.
Nine everyday situations worth slowing down for
1. Identity documents. If someone asks for an NIC, passport or driving licence copy, ask what exact purpose requires it and who will hold it.
2. Bank information. Treat usernames, passwords, PINs, OTPs, CVV numbers and transaction-verification information as private credentials. The Central Bank repeatedly warns the public not to disclose these details to others. CBSL: Be Scam Proof.
3. Screenshots. A screenshot can reveal far more than the part you intended to show: notifications, names, account numbers, email addresses or phone numbers may sit around the main message.
4. Family photographs. A photograph of a child may carry names, school uniforms, locations and routines. The legal question is not the only question; ordinary care matters too.
5. Property papers. A deed, survey plan or assessment document can contain a surprisingly useful collection of personal and property information. Share it deliberately, particularly with unknown intermediaries.
6. Workplace files. Your employer’s document may contain someone else’s personal data. Your right to use a device does not automatically mean you have permission to distribute everything on it.
7. Contact lists. Be cautious with apps or financial services that request access to contacts, photographs or files without a clear reason. CBSL has specifically warned about schemes seeking access to information stored on phones. CBSL warning.
8. Public Wi-Fi and shared devices. Convenience can make people careless about leaving accounts open or saving sensitive files where other users can reach them.
9. The ‘send it quickly’ request. Urgency is not proof of fraud, but urgency is a good reason to verify. A legitimate request can normally survive one sensible question.
What should you do when you are unsure?
Do not panic. Do not automatically accuse the requester. Simply slow the transaction down. Verify the organisation using an official website or known telephone number rather than the contact details supplied in the suspicious message.
If you have already sent sensitive banking credentials, contact the relevant financial institution immediately and follow its security instructions. Keep the messages, numbers, screenshots and transaction records. Evidence is much more useful when preserved before a conversation disappears.
Privacy is not secrecy
There is a humane middle ground between sharing everything and trusting nobody. Good privacy practice means giving the right information to the right person for a clear reason, using a sensible channel, and keeping control over what happens next.
The safest document is often the one you never had to send.
For a broader legal perspective, HICONT’s guides on online consumer problems and used-vehicle due diligence show the same principle in different settings: before a dispute becomes expensive, preserve information and verify what you are being asked to accept.
HICONT quick check
Before pressing Send: identify the recipient, identify the purpose, remove unnecessary information, use the official channel, and keep a record of what you supplied.
This article is general legal information, not individual legal advice. Data-protection obligations can depend on the parties, purpose, type of data and applicable legislation or regulations.