“Where necessary, accredit, license, and register suitable persons to provide data protection compliance services; issue regulations, rules, directives, and guidance under the Act; and register data controllers and data processors of major importance.”