The data protection amendment that cleared Parliament this week is, on balance, a real improvement — but its grievance mechanism still asks citizens to wait for a government-appointed authority to act, with no clear timeline for individual complaints.

An eighteen-month statutory review of the appeals process, the compromise that got the bill across the line, is a reasonable political outcome. It is a poor substitute for a citizen having a fast, enforceable route to redress today.

Lawmakers should use the review not to relitigate the bill's principles but to fix this one gap: a binding timeline for complaint resolution, with penalties for the authority itself if it misses it.