GDPR and Storing Non-EU Citizen Data as an EU-based company

Question

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal information on citizens from these countries and was wondering what the GDPR laws were with reference to an EU company storing non-EU citizen data?

I thought GDPR was to protect the data/information of EU citizens (from Wikipedia):

General Data Protection Regulation (EU) 2016/679 ("GDPR") is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

but wasn't sure if personal information outside of the EU was also protected.

Short version: are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU?

Answer 1

are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU?

Absolutely. The territorial scope of the GDPR is specified at Article 3:

Article 3

Territorial scope

1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

   (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

   (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

As specified in point 1, the regulation applies to controllers and processors located in the EU. There is no exemption of personal data based on the data subject's nationality or location.