3rd, a controller or processor not recognized within the EU might be matter to your GDPR if it procedures the non-public info of information topics from the EU and that processing is relevant to the “checking” in the EU of your “conduct” of data subjects as their conduct usually takes https://socialmediaentry.com/story2989983/cyber-security-consulting-in-usa