The GDPR applies directly across all EU Member States, including the UK, until Exit Day. It regulates the processing of personal data by data controllers and processors with an establishment in the EU; and by those outside the EU which are processing data about individuals who are in the EU for the purposes of providing them with goods and services or monitoring their behaviour. The Data Protection Act 2018 (DPA 2018) supplements the GDPR within the UK by exercising areas for derogation within the GDPR.