Article 27 of the GDPR does not apply to non-EU companies if they are a public authority or body or if the following cumulative conditions are met: