After stoking a valid controversy over protection of personal data and sweeping powers to agencies in handling information through its Data Protection Bill of 2019, the Centre has come up with some good changes in the proposed draft Digital Personal Protection Bill 2022 issued the other day. The delay of three years can be understood given the complex issues linked to personal data and the safeguards needed to protect the information. On the face of it, the draft bill looks to have done a balancing act by providing relief to big-tech companies for use of data in their possession and raising penalty amount to Rs 500 crore for data breach. However, whether the new draft bill can pass the muster of parliamentary debate and Supreme Court’s right to privacy judgement of 2017 will decide India’s future course on data protection. The good thing about the Digital Personal Protection Bill 2022 is the movement it has made on privacy law. The withdrawal of the earlier bill in 2019 had created a confusion among individuals, top companies and foreign-based institutions on how to approach the issue. The new draft now allows the transfer and storage of personal data in some countries while raising the penalty for violations. It has come has a big relief for top global firms like Google, Facebook, Twitter and Amazon whose operations are primarily based on individual data. There was a stringent condition in the earlier bill on cross-border data flow but now with the relaxation proposed in the new draft, the big-tech can transfer personal data of a citizen (only after their deemed consent) outside the country. Though the draft bill will have to pass the scrutiny of the parliament in the coming winter session, the changes and provisions in the law from the earlier bill leave little chance of ambiguity. Of course, there will be concerns over the concept of deemed consent and exemptions proposed for Government departments dealing with issues of national security. The Centre will need to keep its replies ready to allay the fears of policing over individuals or breaching their privacy without the consequence of facing penal action as per the privacy law. Data is the modern day gold. The Government must have a robust mechanism for its lawful collection, storage and transparent handling.