Where is it stated in the GDPR that the GDPR only applies to EU citizens?
<p>I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens. I looked up the GDPR to find the Article or GDPR item that mentions this but could not find it. My question thus is: What part of the GDPR is this mentioned/addressed?</p>
<p>Also, I came across Recital 14 of the GDPR which reads:</p>
<blockquote>
<p>The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.</p>
</blockquote>
<p>Another question I have is: Who does the GDPR refer to as legal persons?</p>

<blockquote>
<p>I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens.</p>
</blockquote>
<p>This conclusion is mistaken.</p>
<blockquote>
<p>Where is it stated in the GDPR that the GDPR only applies to EU citizens?</p>
</blockquote>
<p>It is not stated anywhere because nationality is irrelevant to the GDPR.  The GDPR protects &quot;natural persons&quot; based on their location &quot;in the union,&quot; not on their nationality, and it applies to data processors and data controllers that undertake &quot;activities [through] an establishment ... in the union.&quot;  In addition to the recital quoted in the question, this is specified in article 3, which establishes the regulation's &quot;territorial scope.&quot; For a complete discussion of this matter, consider the <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="noreferrer">EDPB's guidelines 3/2018 on the territorial scope of the GDPR</a> which also provides examples of GDPR protections for people who are not EU citizens.</p>
<blockquote>
<p>Who does the GDPR refer to as legal persons?</p>
</blockquote>
<p>&quot;Legal person&quot; generally denotes natural persons, corporations, partnerships, government entities, and so on.</p>

gdpr european-union