In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the original law. The goal is that people who know a lot about data privacy, rather than random EU representatives, can figure out the specifics.