The GDPR applies to everyone, except "by a natural person in the course of a purely personal or household activity", member states and some authorities.