GDPR applies to (i) people in the EU regardless of where the the company is or (ii) companies in the EU irrespective if the data comes from someone outside the EU
Funnily enough, the GDPR applies not just to foreign companies processing the data of people in the EU, but also to companies in the EU processing anyone's data :-D
GDPR is about data, not companies. It applies to all entities regardless of where they are established as long as they're doing business in the EU or processing data of EU citizens.
The EU claims that even companies not located in the EU are still subject to the GDPR. I don't think the GDPR is applicable in this case tho. It seems likely to pertain to the EU 'right to be forgotten' law(s).
reply