What the new data rules mean for small sites

Most of the obligations already existed. The change is in enforcement, and in who counts as a controller.