GDPR: Who does the EU GDPR Apply To? | Varonis Systems: So under these new rules, if a US company collects data from EU citizens, it would be under the same legal obligations as though the company had headquarters in say France, UK, or Germany — even though they don’t have any servers or offices there!