Much like GDPR, the strict new privacy law governs how organizations collect and manage personal data - and triggers stiff fines for non-compliance.