The information controller decides the purposes for which plus the means by which private info is processed. Your business is service supplier dependent exterior the EU. It provides services to customers outdoors the EU. Its clientele can use its services when they vacation to other nations, like inside the EU. https://www.nathanlabsadvisory.com/blog/nathan/why-penetration-testing-is-essential-for-cyber-security-in-the-uae/