GDPR applies to any business, regardless of its location, that offers goods or services to individuals in the EU, or that monitors the behavior of EU residents. This means that even U.S.-based companies could be required to comply with GDPR if they process personal data of EU individuals.