It can. GDPR applies when you process the personal data of individuals in the EU, even if your company is based in the U.S. Similar requirements apply under UK GDPR for individuals in the United Kingdom.