GDPR has specific exemptions for law enforcement and national security. Governments are allowed to get the data by claiming it's for national security. Some EU countries may have better protections than others.
To give better advice I guess people would want to know what your risk model is. Who do you think is after your data? What do you want to protect?
