The GDPR applies to the processing of personal data carried out by a controller or a processor located in the territory of the European Union, regardless of whether the processing takes place within or outside the European Union. The GDPR also applies to the processing of the personal data of data subjects who are in the territory of the European Union, carried out by a responsible person, or a processor, not established in the European Union, where the processing activities are related to:
(a) the provision of goods or services to such data subjects in the European Union, irrespective of whether payment is made;
(b) the control of their behaviour within the European Union.
The GDPR also applies to the processing of personal data by a responsible person established outside the European Union, where the right of a Member State under public international law applies.