Yes. Your company is required to comply with data protection laws in the country it's located, where it operates, and even where customers come from. This can be rather complex and it’s best to engage the services of a professional such as Fast Offshore to find out exactly what obligations you have.