Data protection, while ensuring individual privacy and spelling out the state’s surveillance powers are the need of the hour. The finalisation of the data protection Bill is a step in that direction. The Joint Committee of Parliament (JCP) adopted the final report on the Data Protection Bill, marking a milestone for India, the largest open internet market in the world that has been trying to frame a privacy Bill for over a decade. India has nearly 800 million internet users and is the biggest market for many Big Tech firms, including Google, Meta (formerly Facebook), and WhatsApp. The country’s laws have, however, not been able to catch up with massive strides in technology and its umbrella Information Technology Act, 2000 does not even contain the words internet or smartphone. Data protection, ensuring individual privacy, and clearly spelling out the state’s surveillance powers are sorely needed, and Bill’s finalisation is a big step in that direction. Any data that has not been defined as personal is considered non-personal data. It can be an anonymous, de-personalised data set held by the government, a not-for-profit, or a large corporation for instance, a data set by Google on how many people take a particular form of public transport on a given route at a specific time each day, or how many people in a locality order what kind of food during the weekends. These are data sets that are stripped of personal identifiers. The Committee has given the government the right to frame legislation around non- personal data and has allowed it to ask for any non-personal data from any data fiduciary. It has been said that a single Data Protection Authority will regulate both personal as well as non-personal data. Experts feel personal and non-personal data should have been kept separate. The government may also get overarching powers by including non-personal data in the Bill. The report has clearly stated that the IT Act has not been able to regulate social media platforms adequately. It has recognized the immediate need to regulate social media intermediaries. It says all social media platforms that do not act as intermediaries should be treated as publishers and be held accountable for the content they host. It has also been said that no social media platform should be allowed to operate in India unless the parent company sets up an office in the country and that a body on the lines of the Press Council of India should be set up to regulate them.