The GDPR applies to any organisations that process the personal data of EU citizens, regardless of whether or not they are based in the EU.