The GDPR regulates "personal data processing," which includes the gathering, use, disclosure, storage, manipulation, and removal of personal data. The GDPR applies to companies based in the EU as well as companies based outside the EU that process personal data in the course of delivering goods or services to EU residents.