As someone not residing in the EU, I don't see how they could possibly enforce that. Best they could do is block my instance I suppose. Have they done that for any small site?
I mean, I would delete/provide all data of any user who requests me to do so for themselves. But I'm likely not following every facet of the GDPR.