GDPR applies to any business that collects any personal information data about individuals. This personal data, or 'personally identifiable information' (PII) includes things from which identity can be derived, such as, for example, a street address, a telephone number, an email address, and even an IP address.