From next May, businesses will have to change the way they look after consumers' data.