GDPR applies to companies/orgs which are (i) based in the EU, or (ii) process personal data of people who live in the EU (regardless of where the corp/org is).

GDPR applies to companies/orgs which are (i) based in the EU, or (ii) process personal data of people who live in the EU (regardless of where the corp/org is). I think lots of EU law applies to residents, rather than citizens of an EU member state. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...