48 Personal Data Protection Act, No. 9 of 2022 “certifying bodies” means, the bodies local or foreign that provide certification services relating to the processing of personal data or qualifications of Data Protection Officers; “child” means, a natural person who is below the age of sixteen years; “consent” means, any freely given, specific, informed and unambiguous indication by way of a written declaration or an affirmative action signifying a data subject’s agreement to the processing of his personal data; “controller” means, any natural or legal person, public authority, public corporation, nongovernmental organization, agency or any other body or entity which alone or jointly with others determines the purposes and means of the processing of personal data; “cross-border data flow ” means, the movement of personal data out of the territory of Sri Lanka for the purpose of processing personal data in a third country; “dactyloscopic data” means, data relating to fingerprints; “data concerning health” means, personal data related to the physical or psychological health of a natural person, which includes any information that indicates his health situation or status; “Data Protection Authority” means, the Authority established under section 28 of this Act;