[amelius]

Ok, what if a EU resident goes on a holiday in the US? Will all their data now be open to malicious treatment for the duration of the trip? Or only the data they enter/view during the trip?

[chc]

You're still a resident of your home country while you're on vacation, so failing to cover any of that data would appear to be a breach of GDPR.

[sirclueless]

Dealing with companies outside the EU is only covered while you are currently inside the EU, regardless of where you reside.