The GDPR requires organizations to protect personal data in all its forms.

It also changes the rules of consent and strengthens people’s privacy rights.

Any organization (companies, charities, even micro-enterprises) that handles the personal information of EU citizens or residents is subject to the GDPR.

That includes organizations not in the EU but that offer goods or services to people there.

https://gdpr.eu/email-encryption/