Incorrect. When talking about companies and other orgs, the GDPR's territorial scope does reach overseas, but is limited. It also doesn't turn on having citizenship of the EU/an EU country; case in point, the UK regulator (ICO) upheld the GDPR rights of a US professor against Cambridge Analytica. What matters is whether either (1) the entity's handling ("processing") of personal data - anywhere in the world - is related to the activities of one of its EU offices, subsidiaries etc; OR (2) if [1] doesn't apply, then GDPR can still apply if you're processing data about persons in the EU/EEA (citizens, tourists, whatever) AND either (a) the processing is related to services or goods you offer those EU persons, or (b) you are monitoring their behaviour in the EU/EEA. There's lots that this test - despite being quite broad - would not catch (and isn't designed to).