The GDPR protects “data subjects” whose personal data are processed by a data controller established in an EU Member State at the time of data processing or whose data are processed by an off-shore controller offering goods and services or tracking their online behavior, provided that such data subjects are physically present in the EU at the time of that processing activity.