Literally the first sentence of the GDPR:
This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
No snark, this situation sucks, but after dealing with GDPR for a while it's not well understood in tech societies