Enforcement of the 2019 Personal Data Protection Act (PDPA) has been postponed for 3 years. A committee member was appointed from the National Security Council as being qualified to protect the national interest. The text contains many exemptions from the law, or do the principles need to make way for the exceptions?