In theory, any individual who visits sites that are based in the European Union is protected. This includes anyone within the union itself and beyond its borders. The regulation also applies to a citizen of the EU whose data exists outside the union. And if you're a citizen of another country who lives in the EU, your data is also protected under the law.