> This Regulation applies to the processing of personal data of data subjects who are in the Union
https://gdpr-info.eu/art-3-gdpr/
Short answer: this applies to people in the EU, citizenship is irrelevant. The law is geographic, not based on passport.
Otherwise, someone might think that being in the EU grants them GDPR rights when dealing with a company in Argentina.
How and will that be enforced is a different discussion, but the regulation clearly protects people in the EU regardless of where the website owner is located.
GDPR is business regulations, phrased as human rights, and makes the most sense if understood as business regulations. I understand that some might choose to hold different opinions about any or all of this.