GDPR applies if: - The data is processed by a company established in the EU (it does not matter where the person / “data subject” is). - The person is in the

GDPR applies if: - The data is processed by a company established in the EU (it does not matter where the person / “data subject” is). - The person is in the EU (whether or not they are an EU national). “Data subjects” are not protected outside the EU against companies established outside the EU. From https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ under “Territorial expansion and applicability of EU law”.