The Digital Personal Data Protection Bill, 2023 has been passed in both houses of the Parliament. The Bill has gone through many versions. Despite this, the version that has been passed has left most independent data privacy experts disappointed. It has come in for even more criticism from Right to Information (RTI) activists, who have charged that the Bill amends the RTI Act, 2005 and weakens it. So, how well does the Bill really fare on the basic metric of protecting a user’s personal data? And where does it fall short? Is there a danger of democratic backsliding with this Bill, like many are saying, or is that an overblown criticism?