Businesses and financial institutions are being left waiting over a new law that will impose financial penalties over data losses.