The treaties and international laws between these countries absolutely allow the EU to enforce GDPR against companies and individuals outside of the EU if it involves an EU citizen as the victim. I know this because I have to work with it every day and I’m from the US.