In reply to Miroslav Glavić.

No so.. If you get the text, you will see that item 1 of the preamble says “The protection of natural persons in relation to the processing of personal data is a fundamental right.” And that “everyone has the right to the protection of personal data concerning him or her.”

That is, it is a regulation regarding the protection of the personal data of people. It does not limit that protection to the EU, though clearly it can only directly apply sanctions to data controllers within the EU.

it does refer to international transfers of personal data in preamble statements 101-108 and data adequacy arrangements with non-EU countries as to whether they are protecting people’s data.

You are, of course, correct that GDPR does not apply as a, say, Serbian law, but a non-compliant Serbian company with European operations/assets could be putting them at risk.