For company legal departments, data-privacy compliance is about to get a lot more complicated.