I thought this, too. But it does depend on location:

    * If your company is EU-based, you must comply with GDPR, whatever the location of your users/clients
    * If your users/clients are EU-based, idem
    * If your users/clients are EU citizens located abroad, it applies *only* if you target EU as a market. If you operate a website dedicated to sell t-shirts to Californian people, and an EU citizen living in California buys from your website, you aren’t expected to comply with GDPR.