What about personal data collected before the Act came into force?

The Act applies to data already held. Where processing continues on the basis of consent obtained earlier, the Data Fiduciary must give the individual a fresh notice, as soon as reasonably practicable, containing the prescribed information, and processing may continue until the individual withdraws consent. In practical terms this means legacy databases need review: consent obtained years ago for a vaguely described purpose may not support what an organisation now wants to do with the data, and where it does not, deletion is often cheaper than justification.