If the data controller/processor is in the EU, the GDPR applies.
If the data subject is physically located in the EU (even if not a citizen or resident) then the GDPR applies.
https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...
Article 3.
If the data subject is physically located in the EU (even if not a citizen or resident) and the data controller purposefully targets data subjects in the union, the GDPR applies.
As per [0]:
the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention
[0] https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta...
"factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."
Now there's the practical question of how the EU enforces that protection against companies that have no presence in the EU, but those that do, the EU has made it quite clear they'll take enforcement action.