GDPR applies to individuals as well as companies if they provide services to customers within the EU/EEA[0], as long as they are either a data controller or dat

GDPR applies to individuals as well as companies if they provide services to customers within the EU/EEA[0], as long as they are either a data controller or data processor, which are explained better than I can in the source below[1]. If the business is based in the US, things get a bit more complicated due to the CLOUD Act[2]. [0]: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... [1]: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... [2]: https://complior.se/cloud-act-and-how-the-new-american-law-can-impact-european-companies/ https://complior.se/cloud-act-and-how-the-new-american-law-c...