who does gdpr not apply to