"These standards govern how a business may collect, transfer or distribute personal data, such as notifying customers before their personal data is collected, providing a mechanism for opting-out, and establishing a process for dispute resolution." . . . .