The correct answer is European Union and the European Economic Area.

European Union and the European Economic Area is correct because the General Data Protection Regulation is an EU regulation that protects the personal data of individuals located in the EU and EEA and it sets binding obligations for controllers and processors who handle that data.

The regulation also has extraterritorial effect and it can apply to organisations outside the EU and EEA when they offer goods or services to or monitor the behaviour of individuals in the EU and EEA. This means organisations in other countries may need to comply when processing the personal data of people in the EU and EEA, but the primary territorial scope remains the European Union and the European Economic Area.

United States is incorrect because the GDPR is not a US law. US federal and state privacy laws govern data within US jurisdictions and GDPR is an EU legal instrument aimed at protecting people in the EU and EEA.

Google Cloud Platform is incorrect because it is a cloud service provider and not a geographic jurisdiction. The GDPR applies based on the location of data subjects and the scope of processing rather than to a specific vendor as a territory.

China is incorrect because the GDPR is not a Chinese law. Chinese law governs data within China and GDPR governs personal data of individuals in the EU and EEA and only reaches organisations in China when they process data of people in the EU and EEA under the extraterritorial conditions set out by the regulation.

Full AWS Practitioner Certification Question