The GDPR applies to personal data of all EU citizens and permanent residents. Even a tourist in the US who browses a website which is only available in the US.

But if the company has no offices, bank accounts or other business presence in the EU, there is no practical way to enforce it.