They are very clear - the GDPR protections apply to those that are "in the Union", and the guidelines clarify that citizenship (and, in fact, legal residency) are irrelevant. One must simply be present in the territory that the regulation applies to (which is EU+EEA). Being a citizen of a EU country and being outside the union, the GDPR protections would not apply to you. Being a citizen of a third country and being inside the union, they would.

> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

(note in the EU - no mention of citizenship)