GDPR doesn’t include things you choose to make public, otherwise no social media could show your posts or username to anyone. My only doubt about Lemmy and Mastodon is about DMs where people have a reasonable expectation that they are private but they are not.

Edit: and thinking about it, even DMs probably fall into the same exception as email.