Mechanisms of enforcement is another discussion but the regulation clearly asserts the scope of data protection as global; it's applicable to all foreign companies processing data of EU residents, whether the companies are based in the EU or not.