The second aspect deals with holding companies accountable when they lose user data. The rules require notification of breaches, a welcome step in an era where digital utilities frequently leak or lose citizen data. Companies must tell users “without delay” when their information is compromised, explaining not just what was taken but what it might mean for them. Equally significant is the mandatory deletion requirement. After three years of inactivity, big platforms must eliminate user data unless legally required to retain it. This “digital sunset” clause recognises that privacy includes the right to be forgotten.

But these protections face practical challenges too. The law itself creates a bifurcated compliance burden for government entities and private organisations. The reliance on the rules on government-authorised mechanisms for verification remains untested, and broad exemptions for certain sectors strike at the heart of privacy protection. Yet despite these contradictions, the rules represent a significant forward step toward digital dignity. Substantial work lies ahead before they are finalised and the industry, as well as users, adapt to a safer digital future.