GDPR isn’t exclusively enforceable on EU-based companies. It may be a regional regulation, but it has a global reach. GDPR protects against the collection, use, and disclosure of personal data from EU residents. Through their websites, companies from anywhere in the world can collect data and use it.