The data that must be handled according to the privacy protections of General Data Protection Regulation (GDPR) is only the EU residents’ data. GDPR is a regulation that aims to protect the personal data and privacy of the individuals who reside in the European Union (EU), and to harmonize the data protection laws and practices across the EU member states. GDPR applies to any organization that processes the personal data of the EU residents, regardless of the location, citizenship, or nationality of the data subjects, or the organization. Therefore, the organization with divisions in the US and the UK must handle only the EU residents’ data according to the GDPR, and comply with the GDPR requirements and obligations, such as the data protection principles, the data subject rights, the data breach notification, or the data protection impact assessment12. References: CISSP CBK, Fifth Edition, Chapter 2, page 87; CISSP Practice Exam – FREE 20 Questions and Answers, Question 18.