The applicability of the GDPR to a non-EU organisation is determined by the so-called ‘targeting’ criterion. It examines the processing of personal data of data subjects in the EU, and whether the processing activities are related to the following: offering them goods or services (these may be free of charge), or monitoring their behaviour within the EU. Find out exactly what this means in our guide on the applicability of the GDPR to companies outside the EU.