The ICO is vague on this point but may follow the GDPRs privacy regulations. This would put any data controller or processor handling data regarding UK residents within the ICO’s jurisdiction. The law pertains to businesses of all sizes.