The EU holds that its citizens’ personal data should be protected as far as possible, even beyond the EU’s borders. The law therefore covers all processing of EU citizens’ personal data, regardless of whether the company or organization doing the processing is located inside the EU or not. An online store in China that targets EU citizens are covered by GDPR in the same way as a company in a country within the EU.