>The GDPR absolutely does apply outside of Europe. No, it doesn't, as you yourself admit two sentences later when you write: >You're pointing out that they ma

>The GDPR absolutely does apply outside of Europe. No, it doesn't, as you yourself admit two sentences later when you write: >You're pointing out that they may not be able to enforce the law against an entity that does not operate in the EU. Yes, which by definition means the law does not apply to that person to entity. That is the fundamental nature of law and sovereignty. >The law itself says so. Completely irrelevant, in the same way it's irrelevant if you or I order some societal change on our say so. Law is about power. And again, also in the exact same way that it's completely irrelevant if Pakistan or whomever have blasphemy laws on the books they say apply to everyone, China laws against "disrupting society" or someone sues a US entity under the UK's very plaintiff friendly libel laws. They can all be told to pound sand. >But even if a company doesn't operate in the EU today, it may want to in the future. Or it may want to be acquired by a company that does. The future is unknowable, so I'd imagine they were advised to follow the law, even if there would be no immediate consequences to breaking it. Sure, but that doesn't mean the law "applies". A company can voluntarily take whatever actions it wishes that it believes may benefit it in the future, but a core point of law is that it's INvoluntary. Since the GDPR doesn't apply to anyone outside of EU jurisdiction (or under treaties giving it local effect), they may choose to run it because they think it's a good idea, or not. Those within EU jurisdiction do not get that choice.