I assume you are from EU state. GDPR is valid only for EU citizens no matter where their data are around the world. If you are company (no mater EU or no-EU) an

I assume you are from EU state. GDPR is valid only for EU citizens no matter where their data are around the world. If you are company (no mater EU or no-EU) and you have personal data breach you should report it to your local regulator in 72 hours or you risk 2mln euro or 4% from the turnover fine. I think one reason Google+ to be closed is they didn't report personal data breach so have to pay 4% of whole turnover of Alphabet which could be billions. In order to be compliant with GDPR companies have to encrypt, mask and pseudo-randomize personal data. This isn't possible even for big companies to be done on time. And on top of this you should have rigorous incident management process so not missing 72 hours deadline. I can tell you that even big companies are not ready.