GDPR applies to EU-based organizations and non-EU entities processing EU citizens’ data, including those offering goods or services to EU individuals.