The law requires all government and private entities or organizations processing personal data establish policies, and implement measures and procedures to ensure and guarantee the safety and security of personal data under their control or custody, thereby upholding an individual's data privacy rights.