A new data protection law adds to challenges faced by foreign firms operating in the massive Chinese consumer market.