The government stepped in to demand an end to WhatsApp's proposed change in its terms of service and privacy policy. The episode should serve as a wake-up call. India has seen an explosion of digitisation, with the pandemic adding momentum. There were over 500 million internet users in India last year, a number that's bound to have gone up. This growth has come in absence of a coherent legislative framework to govern data usage and safeguard privacy, a fundamental right that was established through a landmark Supreme Court judgment in 2017. In December 2019, the government tabled a Personal Data Protection Bill in Parliament. The bill is currently under scrutiny by a parliamentary standing committee, expected to give its report soon. The most comprehensive data protection legislation around is the EU's General Data Protection Regulation. India's data bill could do with much greater emphasis on GDPR's core principles purpose limitation, storage limitation and accountability in use of data. The current bill's exemption for government agencies from its provisions is too loose and all-encompassing. Tighter wording is essential to safeguard against abuse. Given that we are late in legislating, we should legislate to cover emerging concerns. The salient features of the digital economy are extreme returns to scale, network effects and data. That's what triggered the WhatsApp attempt to change its policy. Parliament should take into account the EU's proposed Digital Markets Act which forces gatekeepers such as Facebook and Google to create data silos and thereby check unfair competition. The different strands of the digital economy are intertwined and a legislation on personal data protection should seamlessly merge into a regulatory framework that thwarts monopolisation. GDPR is a good template. Adopting something like GDPR would also facilitate Indian tech and services trade with Europe. There should be no more delay.