The law requires explicit consent for data collection and introduces strict rules for sensitive and cross-border data.