Personal Data Protection & Privacy Notice

Last Updated: 14/09/2026

1. Introduction

MBSL Insurance Company Limited (“MBSL”, “we”, “us or “our”) respects your privacy and is committed to protecting your personal data.

This Personal Data Protection & Privacy Notice (“Privacy Notice”) explains how MBSL collects, uses, discloses, stores and protects personal data when you visit our website, communicate with us, apply for or use our insurance products and services, or otherwise interact with us.

This Privacy Notice is intended to provide transparency regarding our personal data processing practices and should be read together with any specific notices, declarations, consent forms, proposal forms, policy documents, contracts or other terms provided to you in connection with our products and services.

MBSL processes personal data in accordance with the Personal Data Protection Act No. 9 of 2022, as amended, and other applicable legal and regulatory requirements.

2. Who We Are

MBSL Insurance Company Limited (“MBSL”, “we”, “us” or “our”) is an insurance company licensed and regulated by the Insurance Regulatory Commission of Sri Lanka (IRCSL) and provides Life and General insurance products and services.

MBSL respects your privacy and is committed to protecting your personal data.

This Personal Data Protection & Privacy Notice (“Privacy Notice”) explains how MBSL collects, uses, discloses, stores and protects personal data when you visit our website, communicate with us, apply for or use our insurance products and services, or otherwise interact with us.

3. Personal Data We Collect

Depending on the nature of your relationship or interaction with MBSL, we may collect different categories of personal data.

These may include:

3.1 Identification Information

• Name
• National Identity Card (NIC) details
• Passport details
• Driving license details
• Tax identification information
• Photographs and other identification information

Where the data relates to a company or other organization, MBSL may collect and retain relevant information concerning the company, its authorized representatives, directors, beneficial owners or other persons connected with the company, as applicable for the provision and administration of insurance products and services and to meet applicable legal and regulatory requirements.

3.2 Contact Information

• Residential or business address
• Email address
• Telephone or mobile number
• Other contact information

3.3 Professional Information

• Occupation
• Designation
• Employment information
• Professional qualifications
• Other relevant professional or business information

3.4 Financial and Commercial Information

• Bank account details
• Payment information
• Transaction information
• Other financial or commercial information relevant to our products and services

3.5 Insurance and Risk Information

We may collect information required for insurance underwriting, policy administration, claims processing, risk assessment, fraud prevention and other insurance-related activities.

3.6 Health and Other Sensitive Personal Data

Where relevant to the insurance product or service, we may process health information and other sensitive personal data, including medical records, medical reports, diagnostic information and medical history.

3.7 Website and Technical Information

When you use our website, we may automatically collect certain technical and usage information, including:

• IP address;
• browser type;
• device information;
• website usage and interaction information;
• pages visited; and
• information collected through cookies and similar technologies.

This reflects the current website configuration, which includes a contact form and certain third-party website technologies such as Google Analytics and Google reCAPTCHA.

4. How We Collect Personal Data

We may collect personal data from various sources, including:

• directly from you;
• through our website and digital platforms;
• through proposal forms, applications and other documents;
• when you communicate with us by telephone, email or other channels;
• from any intermediaries, insurance agents and/or brokers;
• from reinsurers, loss adjusters, independent or company assessors and medical practitioners;
• from medical practitioners and other professional service providers;
• from persons or organizations authorized by you;
• from regulators and government authorities; and
• from other lawful sources, including publicly available information, where permitted by applicable law.

Our internal PDPA Policy recognizes collection directly from data subjects as well as information received through the above-mentioned channels.

5. Purposes for Processing Personal Data

MBSL may collect and process personal data for purposes including:

• providing and administering insurance products and services;
• underwriting, claims processing and risk assessment;
• customer service and communication;
• fraud prevention, AML/CFT/CPF and sanctions compliance;
• meeting legal and regulatory requirements;
• managing business and operational risks;
• improving our products, services and customer experience;
• statistical, analytical, research and product development purposes; and
• marketing and promotional activities, where permitted by applicable law.

6. Consent and Legal Basis

MBSL processes personal data in accordance with applicable personal data protection and other relevant laws.

Depending on the circumstances, processing may be based on your consent, the provision or administration of our products and services, legal or regulatory obligations, or another lawful basis permitted under applicable law.

Where processing is based on consent, you may withdraw your consent, subject to applicable legal or contractual requirements.

7. Sharing of Personal Data

Where necessary and permitted by law, MBSL may share personal data with:

• insurance intermediaries;
• reinsurers, loss adjusters motor assessors and medical practitioners;
• service providers and technology providers;
• professional advisers;
• regulators and government authorities;
• financial crime prevention authorities; and
• other parties where authorized by you or permitted or required by law.

Third parties processing personal data on behalf of MBSL are expected to maintain appropriate confidentiality and data protection safeguards. MBSL's internal policy also provides for appropriate safeguards for international transfers.

8. International Transfers

Some of our service providers and technology providers may process personal data outside Sri Lanka. MBSL will take appropriate measures and apply relevant safeguards in accordance with applicable personal data protection requirements when personal data is transferred or processed internationally.

9. Retention of Personal Data

MBSL retains personal data for as long as reasonably necessary for the purposes for which it was collected, including to provide our services and comply with applicable legal, regulatory, accounting and other requirements. Certain information may therefore be retained after the end of your relationship with MBSL where required by law and the Company’s managed internal policies.

10. Your Rights

Subject to applicable law and relevant limitations, you may have the right to:

• access your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of personal data where applicable; and
• withdraw consent where processing is based on consent.

Requests may be subject to legal, regulatory or other applicable limitations.

11. Website and Cookies

Our website may use cookies and similar technologies to support website functionality, security and analytics. We currently use third-party technologies including Google Analytics and Google reCAPTCHA. These services may collect technical information such as IP address, browser, device and website usage information. You may manage your cookie preferences through the cookie consent options provided on our website.

12. Security

MBSL takes reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss or destruction. Our website uses security measures including HTTPS/TLS and reCAPTCHA protection for the contact form.

13. Third-Party Websites

Our website may contain links to third-party websites. These websites have their own privacy practices and policies, and MBSL is not responsible for their privacy practices.

14. Changes to This Privacy Notice

MBSL may update this Privacy Notice from time to time to reflect changes in our services, data processing practices, technology or applicable legal and regulatory requirements. The latest version will be published on this website.

15. Contact Us

If you have any questions regarding this Privacy Notice, the processing of your personal data, or wish to exercise your applicable data protection rights, please contact our Data Protection Officer.