3rd, a controller or processor not set up during the EU will probably be matter to the GDPR if it procedures the non-public data of knowledge subjects during the EU Which processing is connected with the “monitoring” while in the EU of your “behavior” of information subjects as their habits https://cybersecurityservicesinusa.blogspot.com/2024/08/aramco-cyber-security-certificate-in.html