GDPR is a protection that applies to European citizens, regardless of where they're situated. companies don't get a pass because they blocked IP addresses coming from Europe.

now, enforcement outside the EU is a challenge, but the law is written in such a way that it covers the personal info of every EU citizen regardless of location.