With the importance of data increasing exponentially in recent years, many countries have enacted new data privacy laws to protect the personal information of their citizens from misuse. These have included the European Union’s General Data Protection Regulation (GDPR), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), South Korea’s Data Protection Act, Japan’s Act on the Protection of Personal Information, among others. India is poised to follow suit as the government considers adopting a comprehensive new data protection law. Risk managers need to understand the provisions of this new law so they can help prepare their organizations to comply and avoid costly penalties.