In this note, the authors analyse the recent Criminal Procedure (Identification) Act, 2022, (‘Act’) against the principles laid down under the General Data Protection Regulation, 2016. These principles relate to data protection and are namely the principles of purpose limitation, storage limitation and accountability, and are also applicable in the Indian legal framework. The authors conclude that the Act fails to abide by the aforesaid three principles and, therefore, there is an urgent need for the legislature to remodel the law in order to safeguard the citizen’s right to privacy and data protection.