Today, data protection law impacts organizations and governments around the world. The EU implemented a higher protection threshold than most other countries with the introduction of General Data Protection Regulation (GDPR) in 2018. GDPR introduced changes to previous data protection and data privacy law, specifically around areas like consent, reporting obligations, internal procedures, accountability, and penalties.
GDPR applies even if you are located outside of the EEA (European Economic Area). It applies to any business that a) markets their products to people in the EEA or b) monitors the behavior of people in the EEA. In other words, even if you’re based outside of the EEA, if you control or process the data of EU citizens, GDPR applies to you.