The GDPR reaches into US-based companies because the GDPR is designed to protect the “personal data” of individuals. The GDPR says it applies to the processing of “personal data of data subjects” controllers and processors who are in the EU, but also to “processing activities” related to: (1) offering goods or services; or (2) monitoring data subject behavior that takes places in the EU. The GDPR replaces the 1995 EU Data Protection Directive which generally did not regulate businesses based outside the EU. However, now even if a US-based business has no employees or offices within the boundaries of the EU, the GDPR may still apply.