I don't know the GDPR well enough to say whether this would apply to fediverse services, and if so, how. My guess wiuld be that it doesn't apply to most instances, but that may change at certain scales, or may apply differently in the case of some of the third-party services that open web advocates have been building, e.g. global search.