3rd, a controller or processor not set up during the EU will probably be matter for the GDPR if it procedures the non-public facts of data subjects within the EU Which processing is connected with the “checking” during the EU of your “actions” of data topics as their habits requires https://agency-social.com/story2994813/cyber-security-consulting-in-usa