Nitpick, but as far as I understand it, it's only EU residents (regardless of their citizenship). The specific text says "data subjects who are in the Union", and citizen never appears in it.
(This is for foreign businesses. EU businesses have to apply it to everyone, regardless of their location or citizenship.)
This means this should be applied to everyone because how do you check that someone is an EU resident? Should websites display a page requesting visitor to upload their residency certificate to be complaint?
(This is for foreign businesses. EU businesses have to apply it to everyone, regardless of their location or citizenship.)