Who Is Subject to GDPR?

GDPR applies broadly to any organization that processes the personal data of individuals located in the European Union (EU) or European Economic Area (EEA)—regardless of where the organization itself is based.

It applies to:

• Controllers: Organizations that determine the purposes and means of processing personal data

• Processors: Organizations that process personal data on behalf of a controller

GDPR applies even if the organization does not have a physical presence in the EU/EEA.
Key triggers include:

• Offering goods or services to individuals in the EU/EEA

• Monitoring behavior of individuals in the EU/EEA

Many global companies integrate GDPR requirements with compliance programs for ISO 27001, SOC 2, HIPAA, and PCI DSS to manage privacy and security consistently across jurisdictions.