The standard is imposed on all companies running in the EU. It is applicable both for European Union-based companies and companies outside the EU if they provide services to EU citizens and process their private data.