Although GDPR is an EU law, it has a global reach. Its protections apply to people in EU member states, regardless of their citizenship or where their data is processed. Even companies based outside the EU have obligations under GDPR if they're processing personal data about individuals in the EU.