"Lemmy" (the software) doesn't have any data. It all resides on servers owned by people other than Lemmy's developers. They have the user data and would absolutely be subject to GDPR.

Again, no matter what Lemmy's devs put in place, it doesn't matter because the instance admins can do whatever they want.