It is based on where you and the business are at, not the users citizenship. If you are in the EU you are covered. If the business is in the EU you are also cov

It is based on where you and the business are at, not the users citizenship. If you are in the EU you are covered. If the business is in the EU you are also covered. Data being processed in the EU is covered (and transferring it to the US is also processing it). In other words the data is covered by the GDPR if it is inside the EU at any point. EDIT: So to answer the question directly: No, if you use a US located business from outside the EU you aren't covered no matter your citizenship, unless the data is being processed in the EU at some point.