From yesterday online businesses that hold personal data will need to deal with individual data protection authorities instead of relying on safe harbour.