The GDPR's geographic reach is also significantly expanded since it applies to any firm that does business with or processes personal data of EU people, regardless of where it is based or where the processing takes place.