It depends on the law. In the case of the GDPR, it does apply despite the person not being physically in the EU.