Article 3(2) provides that:
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or
processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data
subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

The wording of the Article suggests that residency in the EU rather than citizenship of the EU is the criterion for determining the extraterritorial effect of the GDPR