GDPR compliance applies to the data of European (EU/EEA) residents. Therefore, if your US company is processing EU residents data then you must comply with the rules of GDPR. Your US company can be liable if the data is not being processed correctly.  Any company outside of the EU that processes EU residents data must comply with the rules of GDPR. This is in place to protect the data of individuals and sole-traders residing in the EU. Companies can be prosecuted if they receive enough complaints.