Generally only for their own citizens. This covers, for instance, cases of sex tourism.

The German criminal law explicitly covers e.g. all cases of money counterfeiting, human trafficking, and war crimes worldwide regardless of nationality. They have given themselves some binding restrictions on what cases should be prosecuted. Of course enforcement is usually hard to impossible so it does not get used often. But just as an example, a German court has sentenced an Rwandan FDLR president for assisting war crimes even though there is absolutely no connection to Germany.

Germany is not alone in claiming universal jurisdiction for certain crimes.

The EU GDPR regulation applies to people interacting with citizens of the EU, not only EU citizens.

Law can certainly apply to foreign legal entities as defined by the local legislation if the legal code permits such.