Since the turn of the millennium, European citizens' data has been increasingly processed by companies located outside the European Union. While these companies need to comply with the GDPR due to its extraterritorial application, many questions remain as to how EU data protection authorities can enforce the GDPR.