No, that's wrong.

First of all, the GDPR does not take in to consideration citizenship, at all. The Regulation targets location rather than nationality. In other words, if either the data subject or data controller are in the EU/EEA then the GDPR applies, even if the other party is not in the EU/EEA (The UK GDPR is the same, but replace "EU/EEA" with "UK").

Secondly, the GDPR regulates the use of Personal Data, not PII. PII is a US legal term and has multiple definitions. Personal data is a broader concept than PII.