The only way to truly support GDPR is to not store anything in the server. Or anything in the server is e2e encrypted so that only the end user can decrypt it. Even the server operator can't see the data. The content of kind 4 is a good example.

This is an open challenge for the whole industry and NOSTR actually has better chance to really support it in a technical perspective than traditional internet platforms.