Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR?
<p>Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR?</p>
<p>Any help on this questions would be much appreciated!</p>

<h2>Yes</h2>
<p>When personal data is processed in the context of an EU/EEA/UK establishment (for example, by a company with offices in the UK), then all these processing activities must fully comply with the GDPR, regardless of where the data subjects are located.</p>
<p>For the <a href="https://www.legislation.gov.uk/eur/2016/679/article/3" rel="nofollow noreferrer">UK GDPR</a>:</p>
<blockquote>
<p>This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the United Kingdom, regardless of whether the processing takes place in the United Kingdom or not.</p>
</blockquote>
<p>For the <a href="https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en#:%7E:text=Answer-,Answer,the%20data%20is%20processed%3B%20or" rel="nofollow noreferrer">EU GDPR</a>:</p>
<blockquote>
<p>The GDPR applies to:</p>
<ol>
<li>a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or</li>
</ol>
<p>…</p>
</blockquote>

gdpr