Most laws do not apply extraterritorially
There is a general presumption against the extraterritorial application of a law. All legislation is prima facie territorial. Only where a contrary intent appears in the statute does legislation apply extraterritorially. See American Banana, Aramco, and more recently, Morrison v. National Australia Bank, 561 U.S. 247 (2010). Similarly, in Canada, see Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers, 2004 SCC 45, para. 55.
The rationale for the presumption is based in comity at international law.
On that understanding, there are five generally recognized (although still contested to various degrees) grounds on which extraterritorial application of a statute is proper (and again, only if the clear intent is expressed in the statute). See the Restatement (Third) of Foreign Relations Law, or a similar listing in Danielle Ireland-Piper, "Extraterritorial Criminal Jurisdiction: Does the Long Arm of the Law Undermine the Rule of Law" (2012) 13(1) Melbourne Journal of International Law 122
- to a country's own citizens, wherever they are located (the "nationality" principle you're asking about)
- to activities with a substantial territorial effect (the "effects" principle)
- for national security purposes (the "protective" principle)
- over activities universally recognized as crimes against humanity (the "universality" principle)
- where the victim of the act is a national of the state asserting jurisdiction (also known as the "passive nationality principle")
Those are the circumstances where a nation can1 have their law apply extraterritorially. Whether any given law does apply extraterritorially depends on the expressed intent in the law itself.
Some examples where states have relied on nationality to exert jurisdiction extraterritorially are:
- Canada provides for extraterritorial application of its criminal law for offences committed by Canadian citizens on the international space station, as well as for hostage taking, treason against Canada, bigamy, torture, sexual offenses against children, war crimes, and genocide (this is not a complete list, but meant to indicate the kinds of offences where Canada asserts its jurisdiction extraterritorially over its citizens).
- The United States asserts its jurisdiction extraterritorially through criminal laws relating to air travel, customs, spacecraft, and human trafficking and sex offences (this is also not a complete list).
Each the several states of the US can also criminalize extraterritorial conduct of their citizens, as long as the state has a legitimate interest and there is no conflict with federal law (Skiriotes v. Florida, 319 US 69 (1941)). Other than what was ceded to the union, the state retains "the status of a sovereign."
1. Here I mean "can" in the sense of it would be acceptable to other nations generally; in another sense, of course any nation can do anything.