https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ Article 3.1 states that the GDPR applies to organizations that are ba

https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ Article 3.1 states that the GDPR applies to organizations that are based in the EU even if the data are being stored or used outside of the EU. Article 3.2 goes even further and applies the law to organizations that are not in the EU if two conditions are met: the organization offers goods or services to people in the EU, or the organization monitors their online behavior. (Article 3.3 refers to more unusual scenarios, such as in EU embassies.) You definitely are covered by the GDPR - its just a matter of how and when someone will take action against you.