Where does GDPR apply? The answer isn't so simple