Third, a controller or processor not proven from the EU are going to be subject towards the GDPR if it procedures the private info of information subjects during the EU Which processing is connected to the “monitoring” from the EU from the “actions” of data subjects as their conduct usually https://cybersecurityriskmanagementinusa.blogspot.com/