The GDPR applies to all organizations that handle the personal data of EU citizens. Any information about an individual, such as names, email addresses, IP addresses, eye color, political affiliation, and so forth, is referred to as “personal data.” Even if a company is not directly affiliated with the EU, it must abide by the rules if it handles personal data belonging to EU citizens (through tracking on its website, for example).