GDPR's reach doesn't depend on the person or business's location, but on whether this person or this business include european citizen in its target (which can be easy to state for a business, but not that much for an individual).