The scope is wider. It applies to people in the EU, regardless of resident or not. A US resident on vacation in Spain would be covered. See https://cybercounse

The scope is wider. It applies to people in the EU, regardless of resident or not. A US resident on vacation in Spain would be covered. See https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ > 1. A Data Subject under GDPR is anyone within the borders of the EU at the time of processing of their personal data. However, they can also be anyone and anywhere in the context of EU established Data Controllers an Data Processors.