My understanding is that it applies globally, regarding data collected on EU citizens. Enforcement is obviously a question here.