D) It is irrelevant for companies outside of Europe.

B) It establishes rules for protecting the personal data of EU citizens.

C) It requires explicit consent for data processing in many cases.

A) It applies only to companies located within the European Union.