[hak8or]

If it applies or not us irrelevant, what only matters is to what degree is it able to be enforced (and in practice) against companies that have no assets under EU jurisdiction. From what I gather, it's very little, so most smaller companies simply don't care.

[gist]

> what only matters is to what degree is it able to be enforced (and in practice) against companies that have no assets under EU jurisdiction

This is exactly true. Now sure the nervous nellies will be all over what outlier things can happen as is typical. In a practical sense the EU does not have the resources to go after (other than perhaps a few test cases for publicity) anything but the juicy or most flagrant cases.

[nerbert]

Once the discussion on whether the EU can enforce laws over its territory is over, one can think about the content of GDPR and how its guidelines are good practices that your users will appreciate, even if GDPR doesn't apply to you.

[LatteLazy]

Careful. That's what they say about US laws, then your CFO gets arrested in Canada and extradited to the US...

[sabalaba]

Pretty sure that both instances you're talking about (Huawei/Megaupload) are perfect examples of parent's point --- the US is capable of enforcing laws outside of its territory, the EU is not.

[iso1631]

Or New Zealand police raid your house at the behest of the US department of justice