General Data Protection Regulation (GDPR) does not apply to CivicPlus since we do not market to the European Union (EU).
The recent implementation of the GDPR imposes new privacy controls on organizations targeting EU residents. Targeting is the important piece here. Basically, if you are not directly targeting or marketing to EU residents, you are out of the scope of this new regulation.
For example, if a United States (U.S.) city or county is interacting with a resident who may be considering moving to that U.S. city or county, then they are out of scope. However, if that same government entity was advertising directly to EU residents to get them to travel to their city or county, they would be in scope.