The extraterritorial effect of the GDPR is primarily established by Article 3(2). This article extends the regulation's scope to controllers or processors not established in the European Union (EU) if their processing activities relate to either: (a) the offering of goods or services to data subjects who are in the Union, or (b) the monitoring of the behavior of data subjects as far as their behavior takes place within the Union.
Option D perfectly describes the scenario in Article 3(2)(a). A non-EU business that "targets EU customers" is engaging in the "offering of goods or services" to data subjects in the Union, thus triggering the GDPR's application regardless of the business's location.

A. The GDPR does not apply to processing for law enforcement purposes, which is governed by the Law Enforcement Directive (EU 2016/680).
B. The GDPR's scope is determined by the location of the data subject (in the Union), not their citizenship. A non-EU controller processing data of an EU citizen living outside the EU would not necessarily be subject to the GDPR.
C. For the monitoring criterion of Article 3(2)(b) to apply, the behavior being monitored must take place within the Union. This option specifies the behavior occurs outside the EU. ---

1. General Data Protection Regulation (EU) 2016/679, Article 3(2): "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union."

2. European Data Protection Board (EDPB), Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1 (Adopted 12 November 2019), Paragraph 16: "The application of the targeting criterion is not limited by the nationality or legal status of the data subject... The wording 'data subjects who are in the Union' implies that the location of the data subject in the territory of a Member State is the determining factor for the application of Article 3(2)." This directly refutes the citizenship-based logic in option B.

3. European Data Protection Board (EDPB), Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1 (Adopted 12 November 2019), Paragraph 19: This section clarifies that for the "offering of goods or services" criterion to be met, there must be an element of targeting individuals in the EU. This supports the wording "targets EU customers" in option D as the trigger.

4. General Data Protection Regulation (EU) 2016/679, Article 2(2)(d): This article explicitly states that the GDPR does not apply to the processing of personal data "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties..." This makes option A incorrect.