2 points:

1. The primary mechanism for enforcing GDPR is via regulators, not legislation. This is something of an EU/USA culture clash, but the person _complains to a regulator_ rather than lawyering up, so the courts would only be involved in extreme case 2. The jurisdiction is geographical; GDPR applies to persons physically located in the EU irrespective of nationality