The General Data Protection Regulation (GDPR) is an EU law on data protection and privacy, which also applies in the European Economic Area (EEA). Whether it applies does not depend on a person’s nationality: it covers processing in the context of an organization’s establishment in the EU, wherever the people concerned are, and processing by organizations outside the EU that relates to offering goods or services to, or monitoring, people in the EU.

Applying to Non-EU Data Subjects

The GDPR applies to the processing of personal data in the context of the activities of an organization’s establishment in the EU, regardless of whether the processing takes place within the EU or not, and whatever the nationality or location of the people concerned. This means that if an EU-based organization processes the personal data of individuals located outside of the EU, it must still comply with the GDPR.

For example, if a company based in the EU processes the personal data of customers located in the United States, it must comply with the GDPR.

Applying to Non-EU Organizations

The GDPR also applies to non-EU organizations when they process personal data in connection with offering goods or services to individuals within the EU or monitoring their behavior there. For example, if a company based in the United States operates an online store that sells products to individuals within the EU, it must comply with the GDPR when processing the personal data of its customers in the EU.

Conclusion

In conclusion, whether the GDPR applies does not depend on a person’s nationality. EU-based organizations must comply with the GDPR when processing personal data in the context of their EU activities, including data about people outside the EU, and non-EU organizations must comply with the GDPR when they process personal data in connection with offering goods or services to individuals within the EU or monitoring their behavior there.