Both. It applies to whomever processes or collects personal data from individuals located in the EU. There are some exceptions for individuals and smaller companies, but it still does apply.