Just to be perfectly clear here, there is no new law that affects your right to carry out your lawful business in a public space and this includes photography for commercial use in the UK.
New laws were brought in regarding *data protection* specifically the collection and use of personal data with regard to names, addresses, purchasing histories, medical records, etc for commercial use. You cannot collect such information and sell the lists to marketing companies and their like without informing those who complete forms and volunteer the information. There is a specific need for this regarding the internet but it applies to all personal data and has little to do with publication.
That is all. The act is really about freedom of information and an individuals right to know what records are being held by whom and covers what they can and can't do with it without the individual's consent.
That some scare mongering has been going on whereas some have interpreted the new laws to include *photographs* as *personal data* on the fountain of information called *the internet* is really bending both the letter and intent of the legislation to the extreme. Photographs themselves contain no actual personal *data* as covered by the legislation.
EDIT: To be a little clearer on this point, if you were an organisation who invited the public to a public event and then recorded that event and the persons that attended then the complete records you have *including* the photos would be subject to GDPR and you would need the consent of those who attended to *process* or use the information. But this would be no different from the *best practice* guidelines and legislation that already exists. Just the same as a wedding photographer needs consent of the subject if they were to utilise shots for promotional use. It applies to *organisations* and their collection and use of data and an individual's right to access and have the information removed. It does not apply to the occasional photo by a photographer who can claim *legitimate interests* unless the *data* collected compromises or violates an individual's reasonable right to privacy.