Incorrect. When talking about companies and other orgs, the GDPR's territorial scope does reach overseas, but is limited. It also doesn't turn on having citiz

Incorrect. When talking about companies and other orgs, the GDPR's territorial scope does reach overseas, but is limited. It also doesn't turn on having citizenship of the EU/an EU country; case in point, the UK regulator (ICO) upheld the GDPR rights of a US professor against Cambridge Analytica. What matters is whether either (1) the entity's handling ("processing") of personal data - anywhere in the world - is related to the activities of one of its EU offices, subsidiaries etc; OR (2) if [1] doesn't apply, then GDPR can still apply if you're processing data about persons in the EU/EEA (citizens, tourists, whatever) AND either (a) the processing is related to services or goods you offer those EU persons, or (b) you are monitoring their behaviour in the EU/EEA. There's lots that this test - despite being quite broad - would not catch (and isn't designed to).