While GDPR is an EU regulation, it can have an extraterritorial reach. Organizations outside the EU must comply with GDPR if they process the data of EU residents or offer goods/services to EU citizens.