A fraud examiner is based m the United States, a non-European Union (EU) country, and is collecting personal information from their company's human resources (HR) files about an employee based in Spain, an EU country Based on these facts, the fraud examiner would need to comply with the EU's General Data Protection Regulation (GDPR) when conducting their internal investigation.