Recital (25)
Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State's diplomatic mission or consular post.
Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.