It applies if they work with PII of EU citizens. It might be to difficult to enforce the rules, but that is a different matter.