GDPR applies to EU companies only. It is legal in these countries. Not sure what "illegal" means in your comment. Illegal where?

GDPR also states that a non-EU company has to follow GDPR if it offers content accessed from the EU and has presence in the EU (where the fine will be applied). This is normal practice because local law cannot apply cross countries. It is also unfortunate because stronger countries bully weaker ones that way.

The US did that recently. They do not like Iran and decided that US companies will not make business with Iran.

But that was not enough. Any company or country which does will also be punished. Either through their companies on US ground, or through taxes, or through US Dollar trading restrictions.

This is why I said that strong countries can bully smaller ones that way. If this was NK who started that nobody would care. But everyone listens to the US threats (or China, or to some extend Russia or the EU)