State-run and private companies handling personal information will now be required to reduce data collection and obtain user consent.