Consent: Organizations must obtain explicit consent from individuals before collecting or processing their personal data. Data Subject Rights: Individuals have the right to access their data, correct inaccuracies, and request deletion. Data Breach Notifications: Organizations must notify regulators and affected individuals within 72 hours of a data breach. Data Protection Officers (DPO): Organizations must appoint a DPO if they process large amounts of sensitive data.