GDPR is not limited by geography but by data use. U.S. and Canadian companies face rising exposure based on tracking, AI, and internal data practices. Industries handling large-scale data and weak governance face the greatest regulatory risk.