Experts caution that expansive governmental discretion could undermine user rights, while data localisation mandates could pose significant operational challenges for businesses