My understanding is that it applies to data on people in the Union, and data on all citizens of EU countries whether or not they are physically in the union.
If the entity doing the processing is established in the Union then it applies to all of that entity's processing of personal data, regardless of where that processing takes place or the citizenship of the people whose data is being processed.
Same for entities not established in the Union but in a place where Member State law applies. The example they give in the corresponding recital is in a Member State's diplomatic mission or consular post.
For entities not established in the Union what it says it applies to data subjects who are in the Union in regard to activities related to offering them goods and services or monitoring their behavior as far as their behavior takes place in the Union.
