In reply to Bob.

Good luck enforcing that.

You have completely missed the point. The EU doesn't need to enforce the GDPR worldwide in order to reach those outside the EU.

What will happen is this. Organizations with a presence in the EU (and many others doing business with persons in the EU) will adopt polices that comply with the GDPR. This will mean that they will, among other things, contractually require that anyone providing services to them will also have to comply with the GDPR. If those service providers have any sense, they will also include such contractual terms with anyone from whom they obtain services. And so on ...

That's the EU's objective achieved. It won't need to go beyond enforcement against those with a presence in Europe because enforcement outside the EU will, ironically, be done by those found in breach of the GDPR. This is because any such organization will then seek to recoup any fine it pays by pursuing compensation via a claim for breach of contract against any of its service providers who failed to comply with the contractual provision that demanded compliance.